This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

UDP Flood Protection and Streaming Video

So it appears that UDP Flood Protection totally kills some streaming sites such as YouTube for instance. When I have UDP Flood Protection enabled it cripples the speed and it struggles to play 1080P video but if I disable UDP Flood Protection I can stream 4K 60FPS all day long without issue. Is there a simple workaround for this other than trying to round up all possible IP's that any video stream site may use and put them in the exceptions? I feel like there should be a smarter way?

This thread was automatically locked due to age.

0 BAlfson over 7 years ago

You can try playing with the packet rates on the 'Anti-DoS/Flooding' tab. Please report your results here, Chriss.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 sachingurung over 7 years ago

Hi Chris,

Create an IPS exception for UDP port 443. Google services and youtube videos are hosted on QUIC protocol. Refer: https://www.chromium.org/quic.

Hope that helps:)

Sachin Gurung
Team Lead | Sophos Technical Support
Knowledge Base | @SophosSupport | Video tutorials
Remember to like a post. If a post (on a question thread) solves your question use the 'This helped me' link.
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 7 years ago in reply to sachingurung

Sachin's suggestion is definitely the thing to do for this YouTube problem. Reserve my suggestion for similar complaints about other services where the UDP port can't be known in advance. I bet you wind up identifying the IPs individually and adding them to an Exception.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 ChrisProsser over 7 years ago in reply to sachingurung

nm, see below
Cancel
Vote Up 0 Vote Down

Cancel
0 ChrisProsser over 7 years ago in reply to ChrisProsser

Actually I was wrong, it's not fixed. I've tried both of these and though the live logs no longer show UDP Packet Flood entries the video still goes slowly until I disable UDP Flood Protection.
Cancel
Vote Up 0 Vote Down

Cancel
0 ChrisProsser over 7 years ago in reply to ChrisProsser

I went ahead and found a comprehensive list of IP's from Google for YouTube and added them all to the exceptions. Still, if UDP Flood Protection is on, Youtube suffers massively. Live log shows nothing but literally the instant I uncheck and apply to turn off UDP Flood Protection the video starts churning and buffering minutes ahead in the video instead of lagging.
Cancel
Vote Up 0 Vote Down

Cancel
0 ChrisProsser over 7 years ago in reply to ChrisProsser

This actually has helped a great deal.

https://www.sophos.com/en-us/support/knowledgebase/119464.aspx

My IPS cores were set to 0 by default on both my home built box and my SG135 at work. I set the SG135 to 4 and my home to 2 and now its going much faster with UDP Flood Protection on. I can actually stream 4K now and don't see any performance hit with UDP Flood Protection enabled.
Cancel
Vote Up 0 Vote Down

Cancel