<![CDATA[One threat that can disrupt service availability is the Distributed Denial of Service (DDoS) attack—specifically UDP Flood attacks—which can cause bandwidth saturation. This study aims to analyze abnormal traffic patterns on a web server and implement a Snort-based Intrusion Detection System (IDS) alongside a mitigation mechanism using the RAW Firewall on a MikroTik Cloud Core Router (CCR). A quantitative approach was employed, utilizing traffic and network log analysis to identify attack characteristics, including protocols, source and destination addresses, service ports, packet sizes, and packet transmission patterns. Analysis revealed relatively small UDP packets being repeatedly sent from multiple source IP addresses to port 53 (DNS) at high frequency, indicating UDP Flood/DDoS activity. Prior to mitigation, inbound traffic averaged 207.94 Mbps with a peak of 306.20 Mbps , whereas the available bandwidth capacity was only 100 Mbps . This situation caused bandwidth saturation and negatively impacted web server service quality. Mitigation was achieved by applying a RAW Firewall rule on the MikroTik CCR to drop UDP packets destined for port 53 during the *prerouting* stage. Following mitigation, inbound traffic dropped to an average of 43.21 Mbps with a peak of 60.72 Mbps . Consequently, peak traffic decreased by approximately 80.17% , returning to a level below the 100 Mbps bandwidth capacity. The results demonstrate that combining Snort IDS for detection and the MikroTik RAW Firewall for mitigation effectively reduces the impact of UDP Flood/DDoS attacks while enhancing the stability and availability of web server services.]]>
