How DDoS protection works

What actually happens to attack traffic

An attack is just traffic. The whole problem is telling it apart from the traffic you want, fast enough that the difference never reaches the person playing on your server.

Every packet aimed at our range crosses a scrubbing layer before it reaches a customer machine. That layer classifies each packet, drops what it judges hostile and forwards the rest. Our filtering runs as XDP programs at the edge. A hostile packet is classified and dropped there, not after it has been carried all the way to your server. That is why the cost of dropping a packet stays roughly flat as an attack scales. It is also what the 3 Tbps figure on the Shield page measures.

Classification is where the actual engineering lives. A SYN flood looks nothing like a UDP amplification, which looks nothing like an A2S reflection aimed at a Steam server browser. A filter that treats all three the same will either drop real players or let the attack through, and usually both.

Reactive and always-on are different products, not tiers of one

Most hosts blur this, so it is worth being blunt.

Reactive mitigation watches traffic and switches filtering on once it decides an attack is happening. That decision takes time. On our Standard VPS line the window is roughly five seconds. For a web server, five seconds of packet loss is a slow page load and nobody files a ticket. For a Rust server mid-raid it is every player on the box disconnecting at once, and the attacker only has to do it again.

Always-on filtering has no window, because there is nothing to switch on. Every packet crosses the scrubbing layer all the time, attack or no attack. That is the Shield line, and it is the honest reason to pay more for it.

There is a second difference that matters just as much. Reactive filtering operates at layer 3 and 4. It cannot do layer 7 at all.

Layer 3/4 and layer 7 attacks fail differently

A layer 3/4 attack tries to exhaust something countable: bandwidth, packet rate, connection table slots. You measure it in Gbps or Mpps and you can usually watch it arrive on a graph.

A layer 7 attack speaks your application’s protocol correctly. It sends requests that look legitimate because structurally they are. A few thousand well-formed server queries per second will flatten a game server while the bandwidth graph stays completely boring. This is why a capacity number on its own tells you almost nothing about whether your server survives.

Filtering layer 7 means knowing the protocol. That is why we maintain 28+ application profiles rather than one generic filter: FiveM, Minecraft, Rust, SA:MP, RAGE:MP, DayZ, Palworld, TeamSpeak, and generic engines like Valve GameNetworkingSockets and Steam Query for everything that never gets its own line. A profile is what lets the filter tell a real player’s handshake from a crafted one.

What DDoS protection does not do

Worth stating plainly, because the marketing around this is bad.

It does not stop an attacker who already has credentials on your box. It does not fix an application that falls over at 200 concurrent players. It does not help when the bottleneck is a single-threaded game loop rather than the network. And it does not make your IP unfindable: if your server announces itself to a public server browser, its address is public by design.

There is also one limit specific to how any network-level mitigation works. Filtering decisions are made for a range, not for one address in isolation. If an attack targets the whole subnet, mitigation can engage for the entire affected range, which means several customers at once. It is rare, and it is externally caused. It is also a real property of shared network space. Our terms name it, and you should read it here rather than meet it during an incident.