How DDoS Protection Works

"DDoS protected" appears on almost every hosting website, but what does it actually mean? Protection can range from a basic filter that handles small floods to a full network built to absorb very large attacks. This article explains how DDoS protection works, so you can understand what you are buying and ask the right questions.

The Basic Idea: Filter Before The Server

A DDoS attack works because too much traffic arrives at your server. The only reliable way to deal with it is to stop the bad traffic before it gets there. DDoS protection puts a filtering network in front of your server. All traffic passes through that network first, attack traffic is dropped, and only clean traffic continues to your machine.

New to the topic? Start with What Is a DDoS Attack on a Game Server?

The Steps, In Order

1. Traffic Reaches The Provider's Network

Your server's IP address belongs to the hosting network. Traffic sent to it arrives at the edge of that network, where equipment and software can see it before it travels further.

2. Detection

Systems watch traffic patterns all the time. Sudden spikes, unusual packet sizes, traffic from strange sources or too many connections can indicate an attack. Good systems detect an attack in seconds.

3. Containing Large Floods At The Edge

The largest attacks are volumetric, meant to fill the network link. Providers contain these at the network edge, using techniques such as BGP Flowspec, which lets a network push precise traffic-dropping rules to its routers so the flood is cut off early. This keeps the attack away from the links that carry your clean traffic. For example, the case study published about DataForest.net describes volumetric attacks being contained within seconds using this approach.

4. Filtering What Remains

After the biggest floods are handled, filters inspect the rest. They can drop malformed packets, limit abusive connection rates and block traffic that does not match what your service should receive.

5. Layer 7 Filtering

Some attacks look like normal game traffic. Layer 7 (application layer) filters know what real traffic to a game like FiveM or RedM looks like, so they can drop fake connection attempts and queries while real players pass through. This is what separates generic protection from protection tuned for games.

6. Clean Traffic Is Delivered

What is left is legitimate traffic, which reaches your server. In a good setup, players keep playing during an attack and may never notice.

Key Terms

• Scrubbing. Cleaning traffic by removing the attack part.
• Always-on. Protection that is active all the time, not only after you ask for it.
• Zero-loss filtering. A goal where legitimate traffic is not dropped while filtering.
• Transit capacity. How much traffic the network connections can carry, for example 400G ports.
• Geo-blocking. Blocking traffic from countries where you have no players.

What To Ask A Hosting Provider

1. Is protection always on, or do I have to enable it?
2. Where does filtering happen: in the provider's own network or a third party?
3. Do you filter at Layer 7 for my game?
4. Can I manage rules, such as ports and country blocking, myself?
5. Does protection cost extra, and does it have limits?
6. What happens during very large attacks?

Be careful of promises that sound too big. Marketing numbers such as capacity figures mean little without detail on how and where filtering happens, so ask for specifics.

What Protection Cannot Do

No protection is magic. It cannot fix a badly optimized server that lags with no attack, and it cannot protect a service that you leave open on purpose. Keep admin tools private, update your software and follow the advice in How to Secure a Linux VPS for Your Game Server.

How It Works At Linceris.com

Linceris.com runs on AS201129, and traffic passes through DataForest.net, a hosting and network company in Kriftel, Germany that builds its own filtering system. We tune Layer 7 filters for game server traffic. See the DDoS protection page for the traffic path, or look at the VPS packages.