"DDoS protection included" appears on almost every hosting page. The phrase is vague, and it covers very different realities. Here's what you need to understand to know what you're buying.
What a denial-of-service attack is
A DDoS attack tries to make a service unavailable by saturating it. There are two families, with almost nothing in common.
Volumetric attacks drown the network link under a flood of packets. They're measured in gigabits per second. They exploit no vulnerability: they simply fill the pipe. A server behind a 1 Gb/s link falls to 10 Gb/s of traffic, whatever software it runs.
Application-layer attacks are far quieter. A few thousand apparently legitimate HTTP requests aimed at the site's most expensive page are enough to saturate the database. The volume is low; the service goes down anyway.
What network filtering does
DDoS filtering acts upstream, in the datacentre network, before traffic reaches your server. The equipment analyses flows and discards anything that doesn't look like legitimate traffic: DNS or NTP amplification, SYN floods, malformed packets.
It's very effective against volumetric attacks, and that's what matters most for a game server: those attacks aim to cut the match short, not to steal data.
What no filtering will do for you
It's only honest to say it plainly:
- A targeted application-layer attack looks like normal traffic. Network filtering lets it through; rate limiting, caching and application-side protections are on you.
- A weak password isn't a DDoS problem. Most compromised servers are compromised through poorly protected access, not through saturation.
- A vulnerable plugin stays vulnerable, protected or not.
- An internal attack — a player abusing an expensive command — is invisible from the network.
Good habits alongside it
- Don't publish your machine's IP. For a website, put a service in front that hides the origin. A known IP is an easier target.
- Rate-limit at the application level. On an API or a form, a few requests per minute per address is almost always enough.
- Cache. A page served from cache costs a thousand times less than a recomputed one.
- Monitor. An attack spotted in ten minutes is far easier to handle than one discovered the next day.
What to ask a host
Three simple questions:
- Is filtering always on, or enabled on request?
- Is there a capacity limit, and what is it?
- What happens if my service is attacked repeatedly — am I protected, or suspended?
The last question is the most revealing. Some hosts cut off the attacked customer to protect the others. That's a defensible policy, but it should be stated before you order, not discovered during the incident.
Our service status page publishes the availability of every part of the infrastructure continuously.