DDoS Protection for Game Servers: What the Badge Actually Means

Every host advertises DDoS protection. Very few explain what kind, at what capacity, or what happens to your players while it is working.

GameHostReviews Editorial · · Updated

"DDoS protected" is on the front page of essentially every game host. It is close to meaningless on its own, in the same way that "fast" is. The badge tells you the host has bought filtered transit from somebody. It does not tell you what happens when an attack actually lands on your server.

The two problems being solved

Volumetric attacks try to fill the pipe. If the attacker can push more traffic at your server than its connection can carry, everything behind it goes down regardless of how good the machine is. These are the attacks measured in gigabits and terabits, and they are handled upstream — a scrubbing network absorbs the flood and forwards only what is left.

Application-layer attacks are smaller, cleverer and aimed at the game itself. Query-port floods, malformed join packets, connection spam from a rotating set of addresses. The traffic volume can be trivial while still knocking a server over, because it makes the server do expensive work rather than filling its connection.

Almost every host handles the first. Far fewer handle the second, and the second is what a small game server usually gets hit with.

Questions that get real answers

Ask the host:

  1. What capacity, and whose? "Up to 1Tbps" means they resell somebody else's scrubbing. That is fine — most do — but knowing who it is tells you how it will behave. A host who cannot answer this is repeating a line from their upstream's marketing page.
  2. Is filtering always on, or triggered? Always-on filtering means an attack is absorbed before anyone notices. Triggered filtering means someone or something detects the attack first, and your server is down for that detection window — often 30 to 60 seconds, sometimes much longer.
  3. Where does the scrubbing happen? If your server is in Sydney and the scrubbing centre is in Los Angeles, your traffic is crossing the Pacific twice. That is a permanent latency cost you pay for protection you use rarely.
  4. Is there game-aware filtering? Ask specifically about your game. Generic UDP filtering can drop legitimate game traffic, which looks to your players exactly like the attack did.
  5. What happens to me during an attack? The honest answer from a good host is "some packet loss for a few seconds". The answer to worry about is nullrouting — some hosts simply blackhole your IP for an hour to protect the rest of the network. Your server is technically fine, and completely unreachable.

Nullrouting is the one to ask about explicitly. It is common, it is rarely advertised, and from a player's point of view it is indistinguishable from the attack having succeeded.

What you can do yourself

Protection is not only the host's job:

  • Do not publish the server IP more widely than you need to. Most small attacks start with someone in your own community who has the address.
  • Use a whitelist or allowlist where the game supports one. It will not stop a flood, but it removes the entire category of nuisance join-spam.
  • Keep the query port and the game port separate if the game allows it, and restrict the query port if you do not need public listing.
  • Know how to reach support out of hours. An attack at 11pm on a Saturday is when you find out whether "24/7 support" means people or an autoresponder.

The honest summary

Every host has the badge. What separates them is whether filtering is always on, where it happens, whether it understands your game, and whether their answer to a sustained attack is to filter it or to nullroute you. Four questions, and most support teams will answer them straight if you ask.

Compare hosts for these games

Frequently asked questions

For a server among friends, attacks are rare but not unheard of — a single annoyed player is enough. The practical answer is that filtered transit is standard on almost every game host now, so you are unlikely to be choosing between having it and not. What you are choosing is how good it is.

Usually a little, because traffic is routed through a scrubbing point before reaching the server. A well-placed filter adds low single-digit milliseconds. A badly placed one can add thirty by sending your packets to another country and back.

Network-layer filtering blocks floods aimed at saturating the connection — the volumetric attacks. Application-layer protection understands the game protocol and blocks traffic that looks legitimate but is not, such as malformed queries or connection spam. The second is much rarer and much more useful for game servers specifically.

Been through this yourself? Your review helps the next person.

Write a review