We run our own network and filter attacks ourselves. These articles explain what actually happens during an attack and which countermeasures hold up.
Most DDoS attacks are over in minutes, some run for hours. This article shows both using real measurements: an attack at 745.5 Gbps and 73.1 million packets per second that ended after eight minutes, and one at 501.2 Gbps that ran for three hours and 31 minutes. Plus how to read an attack alert field by field, why packet rate often matters more than bandwidth, and why changing port or address would have helped in neither case.
GoldSrc is more than twenty-five years old and answers connectionless queries with no rate limit of its own. Which ports a Counter-Strike 1.6 server really needs, what the query limiter in GoldSrc is actually called, why RCON runs over UDP there, and at what attack size only filtering in the network helps.
The evidence for a DDoS attack exists only while it runs. What to preserve immediately, why the source address usually belongs to another victim, who to contact in which order, and what an abuse report has to contain.
Peer to peer lobbies, your own server list entry, old DNS records, public certificates and the headers of your own outgoing mail: the real paths through which an IP address becomes known, the myths around them, and what actually helps, sorted by effort.
Why reachable backend servers make every measure on the proxy useless, what separates BungeeCord ip_forward from Velocity modern forwarding, how to cap connections per source address, and from which attack size on only upstream filtering helps.
The ping answer on 64738 UDP turns every Mumble server into a reflector for attacks on third parties. What allowping, bandwidth and the connection brake actually do, which configuration file applies after the rename, and where your own firewall stops.
What null routing is in technical terms, how a null route travels through entire networks over BGP within seconds, why network operators set it, what it means for the customer on the receiving end and how to tell whether your own provider works this way.
Brute force, logon floods and volumetric DDoS all look alike on an RDP server and need opposite countermeasures. Tell the three apart by their signatures, lock down port 3389 properly, and know when only upstream filtering helps.
Why the address of a VPN server must be public and sits in every client file, what WireGuard does on its own with mac1 and the cookie reply, how tls-crypt relieves OpenVPN, and from which attack size on only filtering in the network in front of the server helps.
By the time a plugin sees the request, it has already passed nginx and occupied a PHP-FPM worker. The real ceiling is pm.max_children, which is why a Layer 7 attack of 2.4 Mbit/s takes a WordPress site down.
Which of the five UDP ports from 2302 to 2306 an Arma 3 server really needs, how to secure the Steam query, BattlEye RCon and the headless client, and from which packet rate on only upstream filtering helps.
Which ports a Call of Duty server really needs, why game, query and RCON share one port, how to throttle getstatus reflection and RCON attacks, and from which attack size on only upstream filtering helps.
Which ports a Conan Exiles server really needs, how to secure RCON and the query port, why PvP servers get attacked inside the raid window, and from which attack size on only upstream filtering helps.
Which ports a DayZ server really needs, how to secure the Steam query port, BattlEye RCon, the login queue and the startup phase after a restart, and from which attack size on only upstream filtering helps.
With Garry's Mod the game traffic and the server query run over the same port 27015. Which rules on the server actually work, how to secure RCON and Lua network events, and from which attack size on only upstream filtering helps.
Which ports a Left 4 Dead 2 server really needs, how to rate limit the A2S query on 27015/UDP without locking out your own players, what the lobby system achieves as an access filter, and at what attack size only filtering in the network in front of the server helps.
Which ports a private Lineage 2 server really needs, why the login server on port 2106 is the real target, why attacks cluster around server launches, and from which attack size on only upstream filtering helps.
Which ports a Minecraft Bedrock server really needs, why RakNet over UDP without handshake protection is so exposed, how to secure query, RCON and packet rates, and from which attack size on only upstream filtering helps.
Which four UDP ports a Mordhau server really needs, how to secure query port 27015, beacon port 15000 and RCON, and from which attack size on only upstream filtering helps.
An MTA:SA server offers three separate services: the game on 22003 UDP, the HTTP server on 22005 TCP and the ASE query on 22126 UDP. How to secure each of them, and from which attack size only filtering in the network in front of the server still helps.
Which ports a Palworld server really needs, how to secure Steam query port 27015, RCON, the REST API and the 32 slots, and from which attack size on only filtering in the network in front of the server helps.
Which ports a dedicated Project Zomboid server really needs, which servertest.ini directives matter, why the mod check on connect makes the server vulnerable, and from which attack size on only upstream filtering still helps.
Which ports a RedM server really needs, how to secure the HTTP endpoints of the FXServer, txAdmin and the 32 slots, what VORP and RSGCore do differently from ESX, and from which attack size on only upstream filtering helps.
Why Terraria speaks TCP only, which ports the server really needs, how to harden serverconfig.txt, TShock and the REST API on 7878, and from which attack size on only upstream filtering helps.
Which ports a Team Fortress 2 server really needs, how to limit A2S queries, split packets, RCON and rates without dropping out of the server browser, and at what attack volume only filtering in front of the server still helps.
Which ports an Unturned server really needs, why 27017 has been obsolete since 2021, how to limit query floods, join floods and plugin load, and from which attack size on only upstream filtering still helps.
Ports, a rate limit on the query port, RCON and real measurements: what you can secure on an ARK cluster yourself, and at what attack size that is no longer enough.
With Counter-Strike 2 and the Source titles, game traffic and the server query run over the same port 27015. What you can secure yourself, and at what attack volume only filtering in the network in front of the server still helps.
Which ports a FiveM server really needs, how to secure the query endpoints, txAdmin, rate limits and the whitelist, and from which attack size on only upstream filtering helps.
RAGE MP listens on 22005 UDP and 22006 TCP, alt:V on 7788. This guide shows step by step what you can secure yourself and from which point on only filtering in the network in front of the server still helps.
Rust servers are almost always attacked at wipe or in the middle of a raid. What you can secure yourself, where self-protection hits physical limits, and what has to happen upstream in the network.
SA-MP and open.mp handle game traffic, query and RCON over one single UDP port. This guide shows what you can secure yourself, and from which attack size only the filtering in the network in front of the server still helps.
Record the measurements, close ports, limit the query port and packet rates: what really helps during a sustained DDoS attack. And from which size onwards only the filtering in front of the server works.
Close the query port, tighten anti-flood, set a rate limit: what you can secure on a TeamSpeak 3 server yourself. And where those measures stop, because the line in front of it is already full.
Not every overload is an attack. Here is how to use ss, packet counters, kernel messages and web server logs to tell a DDoS attack apart from a load spike or a software bug, beyond doubt.
Why a Hytale server needs exactly one port, what QUIC changes about the attack surface, which filter rule actually works, and from which attack size on only filtering in the network in front of the server helps.
Game servers need their own DDoS protection: UDP, freely chosen ports, sensitive latency. How permanent real-time filtering keeps the game online even while it is under attack.
How a DDoS attack works in technical terms, which four finite resources it occupies, how to recognize it from your own measurements and where the defense on the server ends. With real attack cases from operations.
Specialized DDoS protection for game servers: attacks are filtered in real time instead of taking the IP offline. With real attack cases from live operations.
Nullping attacks need barely any bandwidth and still take down entire BungeeCord networks. How the attack works and how it gets filtered out in real time.
Firewall rules kick in too late once the line is already congested. What actually helps: filtering in the network in front of the server, permanently active and without null-routing.
