DDoS attacks on game servers: how they work and what helps

The server is running, players are online, and then within seconds everyone drops with a timeout. The panel shows the process is alive, the CPU is idle — and still nobody can connect. That is what a DDoS attack usually looks like from a game server admin's point of view. In this article we explain how these attacks work, why game servers are such a frequent target and what actually helps — including what hosting-level protection handles and what you need to take care of yourself.

What a DDoS attack is

DDoS (Distributed Denial of Service) is an attempt to take a service down by sending it more traffic or requests than it can handle. “Distributed” means the traffic does not come from one computer but from a large number of sources at once — typically a botnet of compromised devices or abused public services. That is why blocking a single IP address is not enough. The Cloudflare Learning Center has a good overview.

The goal is not to steal data but to make the service unavailable. For a game server that means players cannot connect, or the latency is so high the game is unplayable.

The three main types of attack

Attacks are usually grouped by the network layer they target. The distinction matters, because each type is defended in a different place.

Volumetric attacks (L3/L4) try to saturate the line. They include UDP floods, where huge numbers of UDP packets are sent at the server, and above all amplification (reflection) attacks: the attacker sends a small request with a spoofed source address to a publicly reachable service (such as a misconfigured DNS, NTP or memcached server), and it sends a much larger response to the victim's address. The server does not have to process anything — it is enough that its uplink is full.

Protocol attacks (L3/L4) abuse the way network protocols work. The classic example is the SYN flood: the attacker opens large numbers of TCP connections that are never completed, exhausting the connection tables on the server or on the network equipment in front of it.

Application-layer attacks (L7) look like normal traffic. For Minecraft this may be a flood of server list pings or so-called bot joins — hundreds of fake players connecting, spamming chat or hammering the login. For a website around the server it is typically an HTTP flood on the store or forum. These attacks need not be large in volume, but they load the application itself.

Why game servers are a frequent target

• Sensitivity to outages. A game needs a continuous connection. Even a short saturation disconnects every player, so the attack is visible immediately.
• Rivalries and personal disputes. Between server communities, attacks show up as “revenge” for a ban or as an attempt to push players towards a competitor.
• Low cost of attacking. So-called booter or stresser services sell attacks cheaply, so even someone without technical skills can order one.
• A publicly known address. A game server's address is public by design — players need it to connect.
• UDP protocols. Many games (FiveM or Minecraft Bedrock, for example) communicate over UDP. Minecraft Java uses TCP, but a volumetric attack saturates the line regardless of which protocol the game uses.

Why a server at home will not survive an attack

A home connection has a fraction of the capacity that even a cheap attack can generate. The whole line saturates, so not only the server goes down but the entire household's internet. Your ISP may also temporarily cut off your address to protect the rest of its network. And because players connect to your home IP, anyone who has ever joined the server knows it. We compare the two options in Minecraft server at home or on hosting?.

What helps against DDoS

No single measure is enough. Protection works in layers, and each layer deals with a different type of attack.

• Always-on filtering at the provider. Volumetric and protocol attacks have to be caught before they reach your line — only a network with enough capacity can do that. It matters that the filter runs permanently (always-on), not only after someone switches it on during an attack.
• Do not expose your home IP. Do not run a public server from home, and avoid dubious voice services or links that can reveal your address.
• Do not leak backend server addresses. In a network behind a proxy, the backends should not be directly reachable. Watch out for old DNS records, forgotten subdomains and plugins that print the address.
• Connection limits in the server software. For example connection-throttle in bukkit.yml, rate-limit in server.properties or login-ratelimit in Velocity.
• A proxy for Minecraft networks. Velocity (or the older BungeeCord) sits in front of the backend servers, unifies login and lets you hide the backends. A backend should accept connections only from the proxy.
• Anti-bot plugins and whitelists. Against bot joins, plugins that verify new players help, as do online-mode=true and, for private servers, a whitelist.
• Up-to-date software. New releases of Paper, Velocity or FiveM artifacts fix bugs that could be abused to overload a server with a small number of packets.

Practical tips for configuring a Minecraft server are in our guides on plugins and server performance.

What BlazeHost's protection handles

Our game servers are protected by 7.4 Tbps DDoS protection by Dataforest. Filtering is always on, included in the price, and there is nothing for you to configure. It works at the network layer (L3/L4): it catches volumetric and protocol attacks before they reach our hardware in the firstcolo FRA4 datacentre in Frankfurt.

We are equally open about what it does not do: it does not filter application-layer attacks. Fake players, connection spam or query floods over the game protocol look like normal traffic to a network filter. Those need to be handled additionally in the server configuration, plugins or proxy — see the previous section. The same applies to a website or store running outside the game server.

Summary

• DDoS attacks on game servers are common, cheap to order and a criminal offence in Czechia.
• Volumetric and protocol attacks (L3/L4) belong to the network provider — without always-on filtering there is no defending against them.
• Application-layer attacks (L7), such as bot joins, are handled in server settings, plugins and the proxy.
• Do not run a public server from your home IP, and do not leak backend addresses.
• At BlazeHost, 7.4 Tbps DDoS protection by Dataforest is included and always on at the network layer; you secure the application layer in your server configuration.

See an overview of our services on the game servers page, with specific plans for Minecraft and FiveM.