how to drop udp attack without port in mikrotik?

hamid1626 · December 28, 2018, 1:48pm

Hi friends
I Have a problem with my CCR Router,36Mbps udp connection without port? do you know what is this and how to block?

sebastia · December 28, 2018, 1:50pm

UDP is a port oriented protocol just like tcp. these may be invalid packets / spoofed or just not reported.

shiyiqiang08 · December 29, 2018, 6:15am

you can use packet sniff to see what it is
or you can use wireshark on pc to see what it is
it is strange ,udp often have it’s port

R1CH · December 30, 2018, 3:22pm

Those are fragments. It looks like you are being attacked by a reflected DNS DDoS amplification attack, there isn’t much you can do about it as by the time you could block it it’s already consumed your bandwidth. You should also ensure you have correct firewall rules to make sure you aren’t actually running insecure DNS too.