UDP Flood Attacks - False Positives

[Migration User]

After upgrading from 11.0.6 MP1 to 11.0.6 MP3, I started receiving many alerts about UDP Flood Attacks.  Most of them are coming from external users, and mainly from home routers (192.168.x.x IPs), many of whom are connecting with VPN. 

The exact message is

Denial of Service "UDP Flood Attack" attack detected. Description: An excessive number of User Datagram Protocol (UDP) packets are being generated on this computer causing 100% CPU utilization.

 

I have tried loosening the alert notification conditions, but it still seems to happen very often.

I have recently updated to 11.0.7, which states that this problem has been specifically addressed, but as of several minutes ago, I have received two identical alerts from two different users/machines, both of them being on completely different home networks.

 

I have been following some threads on this, such as :

https://www-secure.symantec.com/connect/ideas/increase-denial-service-udp-flood-attack-threshold

and

https://www-secure.symantec.com/connect/forums/false-positive-dos-attack-udp-flood-attack-sep-ntp

They are helpful, but it seems they are labelled as "update to version X, as it is fixed", but it still seems to be a problem.

 

Adding exclusions for all the various external users is not a viable option, as we have users that work from home, travel, etc. so their source IPs are never static, nor would we want to open up ourselves to that kind of trouble.

Any help would be great.

Any further information I can provide, I would be glad to do so.
 

Thanks,

-Nate
 

[Rafeeq]

 

Unexpected outbound Denial of Service (DoS) attack

http://www.symantec.com/business/support/index?page=content&id=TECH132487

[Migration User]

All your clients that throw this alert are v.11.0.6300.803 or later?

Just wanted to clarify. I encountered this issue frequently after I upgraded from RU5 to RU6 (MP1a). Upgrading the clients to RU6 MP3 actually resolved the issue for me.

[Migration User]

Rafeeq, thanks for the link to turn off the DoS entirely.  This will be a absolute last step sort of thing, as I like having the DoS protection, and turning it off is more of a workaround then a solution.

[Migration User]

I was not aware that the clients had to be updated to the newest version.  From what I could tell, it seemed the console was the trouble.

I originally updated just the console to 11.0.6 mp3, leaving the clients at 11.0.6 mp1 and then I was slowly pushing out the clients, but clients that were still on mp1 seemed to have the alert (I did it by office, and all of the offices were reporting DoS and UDP flood attackes, etc.

I will now push out the newest 11.0.7 clients to each office and see if that resolves it.   Hopefully it is something as simple as this!

[Migration User]

It's definitely a client-side issue. Here's the fix notes from the MP3 Release Notes:

Resolved a UDP flood attack false positive

Fix ID: 2058022

Symptom: After upgrading to Symantec Endpoint Protection 11.0 RU6, the client detects a UDP flood attack.

Solution: The UDP flood detection thresholds were modified to reduce the occurrence of false positive flood attacks.

 

An unexpected UDP flood attack is reported after upgrading to RU6

Fix ID: 2038207

Symptom: An unexpected UDP flood attack is reported after upgrading to RU6, and blocks what appears to be a legitimate internal DNS server.

Solution: Symantec Endpoint Protection client was updated to verify that the DNS response packet comes from a valid DNS server.

[Migration User]

This was a bit strange to me at first, because I did not have the trouble before I updated the Console.  I updated very few clients but clients that were reporting it were all mixed versions, not just MP1 or the updated ones.  Its like the clients previously had the capabilities to report them, but the console update unlocked/stopped ignoring them.

I saw these release notes, so this is why I upgraded the Console (again, wrongly assuming that the Console was the problem).
Now it makes more sense, as the clients will tell the server about the attack.

Thanks for the info.