DDoS Protection
DDoS protection absorbs or filters flood traffic aimed at overwhelming a game server or the network in front of it. Multiplayer games can be especially exposed: server addresses are handed to players by design, and a targeted attack on one match server can ruin a competitive game for everyone on it.
Also called
DDoS
,
What Is DDoS Protection for a Game Server?
A distributed denial-of-service (DDoS) attack floods a target, or the infrastructure around it, with traffic from many compromised devices, so that legitimate traffic cannot get through (Cloudflare). DDoS protection is whatever spots that traffic and absorbs, filters or reroutes it before players feel it.
Players do not see "an attack". They see lag, disconnects, or a match that ends early. A match runs on one server, so flooding that server affects everyone on it at once.
Attacks come in three families: volumetric floods that fill the connection to the internet, protocol attacks that use up the resources of servers and network devices, and application-layer attacks that overwhelm what answers requests (Cloudflare). In a game they land in different places:
Flood | What it uses up | Where it hits in a game |
|---|---|---|
UDP flood | Bandwidth and packet handling | The game server, which mostly speaks UDP |
SYN flood | The ability to open new TCP connections | Login, backend and web services that use TCP |
HTTP flood | The work of answering requests | The matchmaker and other APIs |
The flood types are the ones Edgegap's documentation lists. Which part of a game each one hits is my own mapping.
Games are easy to find. A server address has to be handed to every player in the match, so it cannot stay hidden. In peer-to-peer games the exposure moves to players: peers learn each other's IP addresses unless a relay hides them, so the target can be a player's home connection.
A shared relay service hides those addresses, but it runs outside the studio’s control. An extensible relay runs on a dedicated server the studio deploys: player IPs stay shielded behind it, the server gets the same upstream protection as any other match server, and the studio can add checks such as who may join a room. The host player still runs the match until the relay runs game logic.
How Does Edgegap Protect Game Servers From DDoS?
Edgegap's protection runs on its distributed network and needs no extra configuration. Its documentation describes four steps:
Detection. It watches for SYN, UDP and HTTP floods, tracking the connection rate per port, per source and in total.
Isolation. The affected machine is marked "Under DoS", and new deployments move away from the targeted site.
Mitigation. Suspicious inbound traffic is scrubbed upstream, with routing and firewall policies at the edge, including a null route, so little bandwidth is wasted.
Recovery. Once the players on the targeted site have disconnected, its IP address is recycled. New matches get a randomly assigned IP and port.
Distribution is part of the design. Edgegap's own analysis argues that a game hosted with one provider in a few locations sits on a narrow range of IP addresses, which makes it simpler to target, and that spreading across providers and locations leaves an attacker with a moving target (article 71, August 2023). Because the response works at the level of the machine and its site, moving new matches elsewhere keeps the rest of the network running.
A word from our sponsor (ourselves!)
Downtime in the middle of a match turns into refund requests. Edgegap commits to 99.99% availability in its terms of service and publishes measured uptime live at status.edgegap.com, so you can check the record instead of taking our word for it.
