A DDoS attack (distributed denial of service) floods a server or its uplink with so many requests from so many sources that legitimate users can no longer get through. The service does not break — it simply stops being reachable. What happens technically, why game servers get hit so often, and which protection actually works takes only a few minutes to understand.
How a DDoS attack unfolds
The first D makes the difference. A plain DoS attack comes from one source and is easy to block. Distributed means the traffic arrives from hundreds to millions of devices at once — usually a botnet of hijacked computers, routers and IoT gadgets whose owners have no idea.
The barrier to entry is alarmingly low: so-called booter or stresser services rent out attacks for a few euros. Worth being clear about: commissioning one is not a prank but a criminal offence — in Germany as computer sabotage under § 303b of the Criminal Code, and comparable laws apply elsewhere, such as the Computer Misuse Act in the UK or the Computer Fraud and Abuse Act in the US. That holds even when the target is just the game server from last night's argument.
Which also explains who gets hit. Alongside extortion and deliberate sabotage, the most common trigger is petty conflict — a lost match, a community feud. Game servers and community projects therefore sit high on the target list.
The three types of attack
DDoS is not one thing. Attacks aim at different weak points, and they need different countermeasures:
| Layer | Typical example | Goal of the attack | Measured in |
|---|---|---|---|
| Volumetric (L3/L4) | UDP flood, DNS/NTP amplification | saturate the uplink | Gbit/s |
| Protocol (L4) | SYN flood | exhaust connection resources | million packets/s |
| Application (L7) | HTTP flood | overload the web server or app | requests/s |
Volumetric attacks are brute force: as many bits onto the wire as possible. Amplification attacks are particularly efficient — the attacker sends small requests with a forged sender address to open services (DNS or NTP servers, for instance), and their much larger replies pour down on the victim.
Protocol attacks such as the SYN flood exploit the mechanics of TCP: they open connections en masse that are never completed, until the connection tables of the server or firewall are full.
Application-layer attacks are the quietest of the three: comparatively little traffic, but every request looks like a real visitor and triggers expensive work — database queries, search pages, logins. They are the hardest to tell apart from legitimate load.
Why you cannot fight this alone
The uncomfortable truth first: against volumetric attacks, nothing on the server itself helps. When 100 Gbit/s meet an uplink of a few Gbit/s, the line is congested before your server could drop its first packet. A local firewall is then filtering debris behind a broken dam.
Effective defence therefore has to sit in front of the server — in the provider's network, where there is enough capacity and the right filtering technology. That is also how you tell whether "DDoS protection" in an offer means more than a marketing word.
What effective protection does
Professional DDoS mitigation works in three stages. It detects anomalies in traffic (a game server suddenly receiving a hundred times its usual UDP packets), it filters the attack traffic out — depending on the system through scrubbing centres or high-performance packet filters directly in the network path — and it forwards the clean remainder to your server as usual. Ideally this runs always-on: protection is active permanently rather than kicking in after minutes of downtime.
At 24fire, that is the standard: both locations are protected out of the box — with in-house filtering at the NTT data centre in Frankfurt, and via the PletX platform at the Skylink site.
What you can still do yourself
Even with protection at the door, there is sensible work left on the server:
- Shrink the attack surface: open only the ports you need; management access such as SSH belongs behind a key and out of public view.
- Cushion layer 7: rate limits in the web server, caching and a lean stack make HTTP floods considerably more expensive to run.
- Protect your IP address: what attackers do not know, they cannot flood — your server IP does not belong in Discord profiles or public status pages.
- Monitor: knowing your normal load is what lets you spot an attack in minutes rather than hours.
Rule of thumb: you do not buy DDoS protection once the fire starts — you choose it beforehand, along with your location. A saturated uplink cannot be rescued from the inside afterwards.
Conclusion
DDoS attacks are cheap to rent, hit game and community servers most often, and cannot be fought off on the target system itself — the filtering has to happen in the network in front of it. So when choosing a provider, check that the protection is described concretely rather than merely claimed. How mitigation works at our two locations, and what it covers, is set out openly on the DDoS protection page.