This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Zoom meetings - IPS UDP Flood detection

Hello,

recently we are seeing huge ammounts of UDP flood detections and drops during zoom meetings since 28.09.2020.

Port is udp 8801.

I created exceptions for all the 100+ networks of zoom.

Still seeing some drops here for IPs not listed in the zoom document. This is only during meetings and so is to be legitimate traffic.

Has anyone seen a recent update from zoom for more network ranges or these IP Ranges in particular?

3.126.162.175
54.154.117.235
193.122.43.71
99.80.203.135

Thanks!

This thread was automatically locked due to age.

0 emmosophos over 4 years ago

Hello LHerzog,

Thank you for contacting the Sophos Community!

I checked for cases mentioning this IPs in case any customer had reported them, but none showed up

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 LHerzog over 4 years ago in reply to emmosophos

emmosophos said:
I checked for cases mentioning this IPs in case any customer had reported them, but none showed up

Thank you emmosophos for your time checking this!
Cancel
Vote Up 0 Vote Down

Cancel
0 emmosophos over 4 years ago in reply to LHerzog

Hello LHerzog,

You are welcome!

Regards,

Emmanuel (EmmoSophos)

Technical Team Lead, Global Community Support
Sophos Support Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 BrucekConvergent over 4 years ago

I think you'll find this will be hard to keep up with; all of these meeting services are seeing a global strain due to the pandemic and as best I can tell their documentation can't keep up with the changes they are making to handle the load. For any of my managed customers that have 3rd party DDoS protection, I have just been disabling Flood detection; it interferes with these types of services as you've seen.

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Sophos Platinum Partner

--------------------------------------

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Cancel