Detecting UDP DoS attack

Question

i am trying to write a program that detects a UDP DoS attack using C++ and WinPcap. What criteria can i use to identify such an attack? I have noticed many UDP DoS generator programs send the same payload over and over again so i can probably detect that but generating random payload is exceedingly simple. Any ideas on what to do?

Answer 1

I'm assuming that the UDP packets will have spoofed IP addresses. If you're not going to whitelist the requests so that you can test them for validity, then you may as well come up with a threshold above which you've decided it's "probably" a DoS attack.