Spoofed UDP packet detection

1 . A method comprising:

generating, by a server, a probe user datagram protocol (UDP) packet, the probe UDP packet having a local address of the server as a source address of the probe UDP packet, a target address of a target as a destination address of the probe UDP packet, and a source port number, the source port number being a first value, the first value being generated from the target address and a random seed;

receiving, by the server, a response UDP packet;

calculating, by the server, a second value, the second value being generated from a source address of the response UDP packet and the random seed;

(a) determining, by the server, that the second value does not match a destination port number of the response UDP packet; and

in response to (a), determining, by the server, that the response UDP packet is not in response to the probe UDP packet.

2 . The method of claim 1 , wherein the source port number is included in an ephemeral source port field of the probe UDP packet.

3 . The method of claim 1 , wherein the first value is further a generated from the local address and a destination port number of the probe UDP packet and the second value is further generated from a destination address and a source port number of the response UDP packet.

4 . The method of claim 1 , wherein:

the first value is a first hash of the target address and the random seed according to a hash function; and

the second value is a second hash of the source address of the response UDP packet and the random seed according to the hash function.

5 . The method of claim 4 , wherein the hash function is a lossy hash function.

6 . The method of claim 1 , wherein:

the probe UDP packet is a first probe UDP packet, the response UDP packet is a first response UDP packet, the target address is a first target address, the target is a first target, the source port number is a first source port number, and the random seed is a first random seed; and

the method further comprises:

generating, by the server, a second probe UDP packet, the second probe UDP packet having the local address of the server as a source address of the second probe UDP packet, a second target address of a second target as a destination address of the second probe UDP packet, and a second source port number, the second source port number being a third value, the third value being generated from of the second target address and a second random seed;

receiving, by the server, a second response UDP packet;

calculating, by the server, a fourth value, the fourth value being generated from a source address of the second response UDP packet and the second random seed;

(b) determining that the fourth value matches a destination port number of the second response UDP packet; and

in response to (b), determining, by the server, that the second response UDP packet is in response to the second probe UDP packet.

7 . The method of claim 6 , further comprising, performing, by the server, a scan of the second target in response to (b).

8 . The method of claim 7 , wherein the scan is a scan of multiple layers of a network stack of the second target.

9 . The method of claim 8 , wherein the scan is a full scan of the network stack of the second target.

10 . The method of claim 1 , wherein:

the probe UDP packet is a first probe UDP packet, the response UDP packet is a first response UDP packet, the target address is a first target address, the target is a first target, the source port number is a first source port number, and the random seed is a first random seed; and

the method further comprises:

generating, by the server, subsequent to generating the first probe UDP packet, a second probe UDP packet, the second probe UDP packet having the local address of the server as a source address of the second probe UDP packet, a second target address of a second target as a destination address of the second probe UDP packet, and a second source port number, the second source port number being a third value, the third value being generated from the second target address and a second random seed;

receiving, by the server, a second response UDP packet;

calculating, by the server, a fourth value, the fourth value being generated from a source address of the second response UDP packet and the first random seed;

calculating, by the server, a fifth value, the fifth value being generated from the source address of the response UDP packet and the second random seed;

(c) determining that one of (i) the fourth value matches a destination port number of the second response UDP packet or (ii) the fifth value matches the destination port number of the second response UDP packet; and

in response to (c), determining, by the server, that the second response UDP packet is in response to the second probe UDP packet.

11 . A system comprising:

one or more processing devices; and

one or more memory devices coupled to the one or more processing devices, the one or more memory devices storing executable code that, when executed by the one or more processing devices, causes the one or more processing devices to:

generate a probe user datagram protocol (UDP) packet, the probe UDP packet having a local address as a source address of the probe UDP packet, a target address of a target as a destination address of the probe UDP packet, and a source port number, the source port number being a first value, the first value being generated from the target address, the local address, and a random seed;

receive a response UDP packet;

calculate a second value, the second value being generated from a source address of the response UDP packet, a destination address of the response UDP packet, and the random seed; and

if the second value does not match a destination port number of the response UDP packet, determine that the response UDP packet is spoofed.

12 . The system of claim 11 , wherein the executable code, when executed by the one or more processing devices, further cause the one or more processing devices to include the source port number in an ephemeral source port field of the probe UDP packet.

13 . The system of claim 11 , wherein the first value is further generated from a destination port number of the probe UDP packet and the second value is further generated from a source port number of the response UDP packet.

14 . The system of claim 11 , wherein:

the first value is a first hash of the target address, the local address, and the random seed according to a hash function; and

the second value is a second hash of the source address of the response UDP packet, the destination address of the response UDP packet, and the random seed according to the hash function.

15 . The system of claim 14 , wherein the hash function is a lossy hash function.

16 . The system of claim 11 , wherein the executable code, when executed by the one or more processing devices, further cause the one or more processing devices to, if (a) the second value matches the destination port number of the response UDP packet, determine that the response UDP packet is in response to the probe UDP packet.

17 . The system of claim 16 , wherein the executable code, when executed by the one or more processing devices, further cause the one or more processing devices to perform a scan of the target in response to (a).

18 . The system of claim 17 , wherein the scan is a scan of multiple layers of a network stack of the target.

19 . The system of claim 18 , wherein the scan is a full scan of the network stack of the target.

20 . The system of claim 11 , wherein the random seed is a first random seed corresponding to a first time period; and

wherein the executable code, when executed by the one or more processing devices, further cause the one or more processing devices to:

calculate a third value, the third value being generated from the source address of the response UDP packet, the destination address of the response UDP packet, and a second random seed corresponding to a second time period prior to the first time period;

if both the second value and the third value do not match the destination port number of the response UDP packet, determine that the response UDP packet is spoofed; and

if either of the second value or the third value matches the destination port number of the response UDP packet, determine that the response UDP packet is not spoofed.