UDP attacks generally fit two profiles:
- Small packets aimed at hammering the application of the server.
- Large packets aimed at exhausting available bandwidth.
There is of course also the possibility of using large packets if the attacker knows that a well-crafted packet can cause additional processing time on the server in excess of the additional bandwidth cost.
Simply dropping UDP packets below a certain size is far too blunt of an instrument to really be commendable, not least because this may well just result in your attacker changing strategy.
For example, if the focus was to hammer your servers, the attacker could switch to an DNS amplification attack that aims to exhaust your available bandwidth.
So what can you do to mitigate these issues or respond? It generally comes down to observing an attack and then profiling it. There are a few basic things you can do such as implementing uRPF at your edge to filter spoofed IPs that do not actually exist on the public internet and using rate-limiting heuristics that will block an IP if it repeatedly sends what you consider "bad" traffic (e.g. rapidly transmitting small UDP datagrams).
When it comes to an active attack, analysis is the key:
Do you observe a common source port, IP (address/range) or payload data within the attack traffic, if so, you have criteria to define a block rule with.
On the other hand, if you're falling victim to a DNS amplification attack or anything that relies on exhausting your available inbound bandwidth - the only real counter-measure if it is killing your throughput is to blackhole the target addresses at your upstream provided. Basically, you sacrifice the reachability of the target for the good of the rest of your network. If it doesn't saturate your links, any decent stateful firewall should block unsolicited DNS response packets.