# Studying the Impact of a UDP DoS Attack on the Parameters of VoIP Voice and Video Streams
## 1 Introduction  
UDP packet flooding is a type of denial-of-service (DoS) attack in which a large number of UDP packets are sent to the attacked server/device in order to overload it so that the attacked device will not be able to process and respond to the sent requests. Unlike TCP, UDP is a protocol where no pre-connection is established between the client and the server before the actual data exchange (packet exchange) begins. When using UDP, no packet loss is detected, and no packet loss messages are sent during the packet exchange between the two devices. Therefore, the use of UDP is characterized by low computational resource utilization and high processing speed. These features make UDP widely used not only for data transmission but also for performing UDP flood attacks. Traditional UDP flood attacks are attacks that aim to occupy as much of the bandwidth/computational resources allocated to the attacked device as possible. During these attacks, the attacker sends a large number of spoofed/customized UDP packets to the attacked device. Typically, these packets are large in size and are transmitted at high speed, causing the connection to become congested or even crash the device. This type of attack now is rarely used, but it still can cause problems due to its simplicity of implementation [1]. Unlike TCP DoS attacks where attackers use TCP SYN packets, in a UDP DoS attack, packets can be fragmented. Fragmentation of UDP packets is used when the size of data transmitted in each packet exceeds the configured MTU of the network. The MTU is the maximum amount of useful information that can be \"packed\" into a single packet. Eachnetwork shall be configured to operate with a different MTU size depending on the pre-purpose of the network. For example, the standardized MTU size for an Ethernet network is 1500 bytes. In Ethernet, it is also possible to use MTU sizes up to 9000 bytes--JUMBO frames--but if the IP network uses PPPoE technology, the MTU size will be automatically reduced to 1492 bytes. Another example: The maximum MTU size for the Wi-Fi standard is 2346 bytes. Again, if a Wi-Fi network is configured with a different MTU, the MTU size of 2346 bytes will be automatically reduced. From what has been shown so far, if the UDP packet is larger than the MTU of the network, it will be dropped or automatically fragmented to a smaller size by the network layer. Therefore, during a UDP DoS attack, the attacker may fragment the packet size of the UDP attack in advance to allow the attack to be successful or disguised as a small MTU packet stream in order to avoid/bypass any defenses. The use of packet fragmentation in a UDP DoS attack can be beneficial in low-speed networks. In this scenario, if fragmentation is not used instead of blocking the attacked device, the entire network where the attacked device is located will be blocked/congested, and the attack will not be successful and may even lead to the attacker being quickly and easily detected. Therefore, UDP DoS attacks with fragmented packets can cause the same, if not more, damage as a simple UDP DoS attack without using fragmentation packets. The goal of the TCP SYN packet is to initiate a connection and receive a SYN/ACK response as a result. Typically, the SYN segment does not contain any data. This packet is small, so there is no reason for it to be fragmented. A fragmented SYN packet is irregular, unnatural and as such suspicious. Therefore, such packets may be intercepted and dropped by the receiving device. Therefore, in TCP SYN DoS attacks, fragmentation is not possible. Another reason why UDP flooding is more dangerous than TCP flooding is that UDP is a connectionless protocol. This means that there is no need to pre-establish a connection between devices before the data exchange is started. Because of this, a UDP flood (UDP DoS attack) can easily overwhelm the attacked device with spoofed packets. In VoIP technology, the transmission of useful data (voice and video) is carried out using the UDP protocol.