Anti-DDoS protection for game servers
Game hosting has two properties attackers exploit at the same time: the traffic is UDP based and mercilessly sensitive to latency. A player does not need full unavailability to leave. A ping spike lasting a dozen seconds is enough. That is why we filter in Poland, on a short path, instead of hauling traffic through a foreign scrubbing centre.
In games the effect of an attack is immediate and public. The server empties within a minute, players complain on Discord, and some of them never come back. Attacks are often aimed at exactly that: a competitor or an offended player pays a few euros for a booter service to ruin your evening peak.
What goes wrong
- Game traffic is UDP, so you cannot simply block it without killing the service
- A foreign scrubbing centre adds hops, and in gaming ping is the product
- Attacks come back at peak time, in the evenings and at weekends, because that is when they hurt most
- A booter costs about as much as lunch, so the attacker can be any player
- Per-IP protection does not help when the attack spreads across the whole server pool
What we do about it
- Stateful filtering tells packets belonging to a player session apart from an out-of-context flood
- Scrubbing happens in our network in Poland, so the path stays short
- UDP amplification and reflected traffic are dropped, because nobody asked for those replies
- The filtering profile is set for the specific ports and protocols your servers use
- An attack at eight on a Friday reaches an on-duty NOC rather than a voicemail box
How it works for you
UDP without throwing the baby out
Blocking UDP ends the game, not the attack. Stateful filtering distinguishes traffic belonging to a session a player actually established from packets arriving out of nowhere. That way the flood can be dropped without touching the protocol the whole service runs on.
A short path instead of a detour
Global scrubbing providers take traffic into their own infrastructure, often outside Poland, and hand it back through a tunnel. For a website that is invisible, for a game server it is the difference between playing and complaining about lag. We filter in our own network and connect at Polish exchanges and data centres.
Protection for the whole server pool
Game hosting usually hands out addresses from one pool, and attackers know it and spread the flood across the whole prefix. We filter the prefix as a whole, with no per-address thresholds, so that tactic does not slip past detection.
The full picture
The mechanics are the same for every segment: SkyGuard, our own stateful engine, filters every packet at the AS202520 edge, always-on or on-demand, with no RTBH and no blackholing. The main Anti-DDoS page covers the engine, the modes, reflected traffic, carpet bombing and how we compare against blackholing and outsourced scrubbing.
Frequently asked questions
Will the protection raise players' ping?
Protected traffic runs through our network, so the path changes and we do not hide that. The difference is where we take it: we filter in Poland, connecting where you already are, so the path stays domestic and short instead of running to a scrubbing centre in another country. During the quote we can check together on a traceroute what the specific path from your location looks like.
Can you handle attacks aimed at individual players?
If the attack targets addresses we carry for you, yes, because we filter the whole prefix. We cannot protect a player's home connection, since that sits outside our network. In practice the most common problem in game hosting is an attack on the server address rather than on an individual player, and that case we handle in full.