Built-In UDP Flood Protection in SEGGER emNet: How It Works

UDP floods are among the simplest denial-of-service attacks against networked embedded systems. An attacker sends a high volume of UDP packets to random or known ports on the target. For each packet, a traditional TCP/IP stack must receive it into a buffer, pass it through the IP layer, check the UDP port table, find no matching socket, generate an ICMP “port unreachable” response, and free the buffer. On a resource-constrained microcontroller, this sequence, repeated thousands of times per second, saturates the CPU and starves the application.

The device does not crash. It simply becomes unresponsive because every cycle is spent processing garbage packets.

Filtering at the Driver Level

SEGGER emNet addresses this with UDP flood protection that operates at the network driver level, below the IP stack’s main processing task. When a UDP packet arrives, emNet performs a lightweight check before passing it up to IP_Task for full processing.

The check examines two fields: the destination IP address and the destination UDP port. If the packet targets a unicast IP and the port does not match any open socket, emNet discards it immediately at the driver level. The packet never enters the IP_Task’s input queue, never triggers IP header parsing, never causes a socket table lookup, and never generates an ICMP response.

This is a meaningful architectural difference. In a stack that processes every packet through the full IP path, a UDP flood of 10,000 packets per second can consume 50-80% of a Cortex-M4’s CPU time. With emNet’s driver-level filter, the same flood consumes a fraction of that.

What the Filter Does Not Block

The filter is intentionally selective. It does not discard UDP broadcast packets on ports with open sockets. This is critical because protocols like DHCP rely on UDP broadcast, a DHCP client listens on port 68, and server responses are often broadcast.

emNet discards a packet only when all of the following are true:

The packet is UDP
The destination IP is unicast (not broadcast, not multicast)
No socket is bound to the destination port

Legitimate traffic to open ports is never affected, broadcast-based protocols continue to function, and multicast traffic is handled normally.

Available Since emNet 3.20

The UDP flood protection feature is available in emNet version 3.20 and later. Upgrading to a current emNet release through GSAS provides the protection along with other stack improvements.

Minimal Overhead

The per-packet overhead is minimal, two comparisons against the destination address and port, plus a socket list lookup. On a Cortex-M4 at 168 MHz, this adds single-digit microseconds per packet. The overhead of not having the filter, full stack processing for every flood packet, is orders of magnitude larger.

For systems where determinism matters (industrial control loops, real-time sensor acquisition), the difference between driver-level discard and full-stack processing can determine whether the application meets timing deadlines during a network attack.

Practical Implications

Any embedded device with an Ethernet or Wi-Fi interface on a shared network is a potential target, whether from intentional attacks, misconfigured devices, broadcast storms, or test equipment. Industrial PLCs, building automation controllers, IoT gateways, and medical devices all operate in environments where network traffic is not fully controlled.

emNet’s approach requires no configuration. No filter rules, no firewall tables, no application code changes. The protection is built into the stack and operates automatically.

emNet and SEGGER Networking in India

GSAS Micro Systems provides SEGGER emNet along with emSSL, emMQTT, emWeb, and emFTP with INR invoicing and local engineering support. Teams across Bengaluru, Hyderabad, Chennai, Pune, Mumbai, and Delhi NCR can access technical consultation for networking stack integration and connected device development.