UDP

Connectionless Transport

UDP (User Datagram Protocol) is a transport-layer protocol that sends packets (datagrams) to a destination without establishing a connection first and without guaranteeing delivery, ordering, or duplicate protection. Each UDP packet is independent — there is no handshake, no acknowledgment, and no retransmission. This makes UDP extremely lightweight: the header is only 8 bytes compared to TCP's 20+ bytes, and there is no round-trip delay before data starts flowing.

Use Cases

UDP's low overhead makes it the right choice when speed matters more than guaranteed delivery. DNS queries use UDP port 53 — a query and reply fit in a single exchange with no handshake overhead. Video streaming and VoIP use UDP because a slightly delayed or dropped frame is better than pausing to retransmit it. Online games use UDP to send position updates many times per second. WireGuardA modern, lightweight VPN protocol that uses state-of-the-art cryptography (ChaCha20, Curve25519) with a minimal codebase (~4,000 lines). Designed for simplicity, high performance, and low latency compared to OpenVPN and IPSec. uses UDP exclusively because its own protocol handles reliability where needed. QUIC (the basis for HTTP/3) also runs over UDP.

UDP and Security Risks

Because UDP is connectionless, servers that respond to UDP packets with larger responses than the request can be exploited for DDoSDistributed Denial of Service. An attack that overwhelms a target server or network with massive traffic from many compromised sources (a botnet), rendering the service unavailable to legitimate users. amplification. An attacker sends a small spoofed UDP request (with the victim's IP as the source) to a service like DNS, NTPNetwork Time Protocol. A protocol for synchronizing clocks across computer networks to within milliseconds of Coordinated Universal Time (UTC). Critical for logging, authentication, and distributed systems., or SNMPSimple Network Management Protocol. A protocol for monitoring and managing network devices (routers, switches, servers) by collecting metrics and configuration data. Agents on devices report to a central SNMP manager., which then sends a large response to the victim. Rate limiting, ingress filtering (BCP38), and response size limits mitigate amplification. Use Open Port Checker to check which UDP ports are exposed on a host.