UDP

What is UDP?

UDP (User Datagram Protocol) is a lightweight, connectionless transport protocol that sends individual data packets (datagrams) across an IP network without first setting up a connection and without acknowledgement, retransmission or ordering guarantees. UDP was defined in RFC 768 in August 1980 and operates at layer 4, the transport layer, of the OSI model, alongside TCP. Because there is no handshake and no waiting for acknowledgements, you choose UDP where speed, low latency and multicast matter more than guaranteed delivery.

In OT networks a great deal of infrastructure and process traffic runs over UDP: SNMP, Syslog, NTP, PTP, cyclic I/O of IP and building protocols such as BACnet and KNX.

🧠 How does UDP work?

UDP adds only an 8-byte header to an IP packet, with four fields of 2 bytes each:

How it works in short:

1. No connection setup: the sender transmits immediately, without the three-way handshake of TCP
2. No acknowledgement or retransmission: a lost datagram stays lost; the application itself must deal with packet loss
3. No ordering guarantee: datagrams may arrive in a different order from the one in which they were sent
4. Error detection, but no correction: the checksum lets the receiver discard corrupted datagrams, but does not repair them
5. Unicast, broadcast and multicast: UDP can send one message to many receivers at once, which TCP cannot

In theory a UDP datagram can be 65,535 bytes long (65,507 bytes of data over IPv4), but large datagrams are fragmented and are then lost more easily: if one fragment goes missing, the whole datagram is lost. Many industrial protocols therefore keep their messages within a single Ethernet frame: with a 1,500-byte MTU that means at most 1,472 bytes of data over IPv4 and 1,452 bytes over IPv6.

🔄 What is the difference between UDP and TCP?

For cyclic process data, retransmission is often pointless: a sensor reading that arrives late has already been superseded by the next one. That is why real-time protocols that run over IP usually use UDP and check for themselves whether data arrives on time, for example with a timeout or sequence number. For configuration, file transfer and write commands to a controller, TCP is the better choice.

🏭 Which industrial protocols use UDP?

Two important nuances for the energy sector: classic GOOSE and Sampled Values messages from IEC 61850 do not use UDP. They run directly over Ethernet (layer 2, EtherType 0x88B8 for GOOSE and 0x88BA for Sampled Values) and therefore stay within a single VLAN. Only the routable variants R-GOOSE and R-SV from IEC 61850-90-5 wrap these messages in UDP/IP multicast so they can travel between substations over a routed network. PTP profiles for the power sector also usually run at layer 2.

🔐 What are the security risks of UDP?

Because UDP has no session and no handshake, the protocol does not verify who the sender is. That leads to three typical risks:

• Spoofing: an attacker can easily forge the source IP address, because no handshake confirms it
• Flooding: a UDP flood fills the bandwidth and buffers of a device; simple field equipment with a limited network stack may fail as a result
• Amplification: in a DDoS attack, the attacker sends small requests carrying the victim’s forged address to open UDP services, which send back far larger responses

In its advisory on UDP-based amplification, CISA lists amplification factors including these:

In addition, many OT protocols over UDP have traditionally been unencrypted and lack authentication: SNMPv1/v2c sends the community string in plain text, Syslog over UDP can be forged without anyone noticing, and BACnet/IP and KNXnet/IP in their basic form accept commands from any device on the network. Good network security therefore has to compensate for what the protocol itself does not provide.

🔧 How do you secure UDP traffic in an OT network?

A practical approach in five steps:

1. Inventory: use passive monitoring or Wireshark to map which UDP ports are actually in use, per zone and per device
2. Segment: place systems in zones following the zones and conduits model of IEC 62443 and keep broadcast and multicast within their own VLAN; use network segmentation and IGMP snooping on switches to contain multicast
3. Filter: on a firewall, preferably an industrial firewall, allow only the required UDP ports between known addresses; use ACLs on switches and block UDP from the internet entirely, including SNMP, NTP and DNS
4. Choose secure variants: SNMPv3 with authentication and encryption, Syslog over TLS (RFC 5425), NTP with Network Time Security (RFC 8915), and CIP Security for EtherNet/IP, which uses TLS and DTLS, and KNX IP Secure for KNXnet/IP; a VPN for links between sites
5. Monitor: have an IDS or network monitoring flag anomalies in UDP traffic, such as new ports, unexpected multicast groups or sudden spikes, and send the logging to the SIEM

These measures align with the requirements for network segmentation and restricting unnecessary services in IEC 62443-3-3, and with the duty of care for network and information systems under NIS2.

❓ Frequently asked questions

Is UDP unreliable?

UDP does not guarantee that a datagram arrives or arrives in the right order, but its checksum does detect corrupted data. In a well-designed industrial network that is not congested, few UDP packets are lost. Protocols that run over UDP handle reliability themselves with sequence numbers, timeouts or by repeatedly sending the current value.

Why do real-time protocols use UDP instead of TCP?

Real-time protocols use UDP because TCP waits and retransmits after packet loss, which causes delay and jitter. With cyclic process data the next value is already on its way, so retransmitting an old value is pointless. UDP also supports multicast, allowing one sender to serve many receivers at once.

Which UDP ports matter in OT networks?

Common UDP ports in OT are 161/162 for SNMP, 514 for Syslog, 123 for NTP, 319/320 for PTP, 2222 for EtherNet/IP I/O, 47808 for BACnet/IP, 3671 for KNXnet/IP and 4840 for OPC UA PubSub. Vendors may use different ports, so always check the device documentation. A firewall should only pass the ports that each connection needs.

Does GOOSE in IEC 61850 use UDP?

Classic GOOSE in IEC 61850 does not use UDP; it runs directly over Ethernet at layer 2 with EtherType 0x88B8. As a result GOOSE is not routable and stays within one VLAN or substation. Only R-GOOSE from IEC 61850-90-5 wraps GOOSE messages in UDP/IP multicast to send them across routed networks.

Can UDP traffic be encrypted?

UDP traffic can be encrypted with DTLS, the datagram version of TLS, or by sending it through an IPsec or other VPN tunnel. QUIC, the basis of HTTP/3, also runs encrypted over UDP. In OT many older devices do not support encryption, so segmentation and filtering remain the key measures.

How do you recognise a UDP flood or amplification attack?

You recognise a UDP flood or amplification attack by a sudden spike in UDP traffic towards a single target, often with large response packets from services such as DNS, NTP or SNMP. Network monitoring and an IDS show this as a deviation from the normal, predictable OT traffic pattern. Prevent your own systems from being abused by never exposing these services to the internet.

📌 In summary

UDP is the fast, simple transport protocol beneath many OT services, from SNMP and Syslog to PTP, EtherNet/IP I/O and OPC UA PubSub. It lacks acknowledgements, ordering and sender verification, which is why UDP traffic calls for segmentation, strict port filtering, secure protocol variants and monitoring.

UDP trades reliability for speed and multicast, which makes it ideal for real-time OT traffic, but it is only safe within a well-segmented and monitored network.