Game Server DDoS Protection Explained: What 40Gbps Means
A DDoS (distributed denial-of-service) attack tries to knock your server offline by flooding it with more traffic or requests than it can handle. Network-level protection filters that flood before it reaches your server, and a figure like 40Gbps describes how much attack traffic the protection can absorb before it is overwhelmed.
Protection reduces the risk; it does not make you immune, and it is only part of the picture. This guide explains the attack types in plain terms, what the numbers mean, and what you can do yourself.
- A DDoS floods your server with traffic from many sources at once, so your real players cannot get through.
- Layer 3/4 attacks target bandwidth and connection handling; Layer 7 attacks target the application and can look like normal requests.
- Gbps tells you how much volume the protection can handle, but speed of detection and filtering accuracy also matter.
- Never publish your server IP where you do not need to, and secure RCON, web dashboards and admin panels.
- Check graphs first: a flood and plain overload look different.
On this page
What is a DDoS attack on a game server?
Cloudflare defines a DDoS attack as a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming it with a flood of Internet traffic. The traffic usually comes from a botnet: many compromised devices, often ordinary computers and IoT gadgets, all told to send requests at one IP address. Because every bot is a real device, the attack traffic is hard to tell apart from legitimate traffic.
Game servers are attractive targets for several reasons. They have a public address, many run over UDP (a connectionless protocol that makes it easy to send packets with forged source addresses), and an outage is immediately visible to a whole community.
Layer 3/4 vs Layer 7 attacks
The OSI model describes networking in layers. Layer 3 is the network layer (IP packets), Layer 4 is transport (TCP and UDP), and Layer 7 is the application layer (the protocols software uses, such as HTTP). DDoS attacks are grouped by what they overwhelm.
| Type | What it targets | Examples | Typical symptom |
|---|---|---|---|
| Volumetric (L3/L4) | Your bandwidth: the pipe into your server | UDP floods, amplification attacks | Everyone's ping spikes or drops at once, even if the game process is idle |
| Protocol / state-exhaustion (L3/L4) | Connection tables, firewalls, packet handling | SYN floods | New connections fail, existing ones may hold |
| Application (L7) | The service itself, with requests that look legitimate | HTTP floods against web dashboards, maps or APIs; request floods against a game's own query or login handling | High CPU or memory on the server with seemingly normal traffic |
Cloudflare's explainers note that protocol attacks exploit weaknesses in layers 3 and 4, and that application-layer attacks make cheap requests that cost the server a lot to answer, which makes them hard to filter because the traffic looks legitimate. For a game server, Layer 3/4 floods are the classic case; Layer 7 matters most if you expose a web service (a status page, web map or dashboard) or a login or query endpoint that can be hammered.
That is why hosts often separate the two: Layer 3/4 protection filters at the network edge, while Layer 7 protection must understand what valid traffic for that service looks like. ChicagoServers includes 40Gbps of DDoS protection on every server and offers an optional paid upgrade for Layer 7 protection.
What does 40Gbps of included protection mean in practice?
Gbps measures capacity: how many gigabits of attack traffic per second the protection can absorb and filter. If an attack stays below that figure, it can be scrubbed so that clean traffic still reaches your server. If an attack exceeds the capacity of the pipe or the filtering system, the link can saturate and legitimate traffic suffers. A large number means a bigger margin, and no number means invulnerable.
Be careful comparing hosts by Gbps alone. Other questions matter just as much:
- Always on or on-demand? Protection that switches on after an attack begins leaves a gap. Always-on filtering has none.
- Time to mitigate: how many seconds or minutes before filtering takes effect?
- Packets per second: small-packet floods can exhaust devices long before they fill a bandwidth pipe.
- False positives: aggressive filters can drop real player traffic, particularly fast UDP game traffic. Ask whether game protocols are tuned for.
- Layer 7: is application-layer protection offered, and is it an add-on or included?
Read the details of what ChicagoServers includes on the DDoS protection page.
Is it a DDoS or is my server just overloaded?
Plenty of lag blamed on attacks is really overload, a bad mod or a full disk. Use your graphs before you assume the worst.
- Looks like overload: CPU or memory is high, players drop gradually as load climbs, and the problem repeats at the same in-game triggers (a big base, a world save, a particular mod).
- Looks like a flood: players drop at once with no matching spike in CPU or memory, pings jump for everyone, and the trouble comes and goes in bursts.
- Looks like application abuse: CPU or connections climb while the player count stays flat or low.
If you suspect an attack, contact your host's support with the time window and what you saw.
How to reduce your server's exposure
Protection works best when attackers cannot easily find, or abuse, your server. These habits cost nothing:
- Do not leak your IP. Avoid putting the raw IP:port in screenshots, streams, videos and public Discord posts when a hostname or server-browser entry will do.
- Use a hostname you control so you can repoint players without rewriting everything, and so the raw IP is not what people see.
- Lock down remote administration. The Minecraft Wiki warns that RCON is not encrypted and should ideally be used only from localhost. Use strong, unique RCON passwords and do not expose admin interfaces you do not use.
- Switch off optional web services. In 7 Days to Die, the web dashboard (default port 8080) and Telnet (8081) matter only if remote administration is enabled; the Valve Developer Community wiki lists both. Do not enable what you do not need.
- Whitelist or add a password if the server is for friends, so strangers cannot probe it freely.
- Keep sub-user access tight. Give co-admins only the permissions they need and remove people who leave.
- Keep the game and any plugins updated so known crash exploits are patched.
What DDoS protection does not do
- It will not fix lag caused by an under-sized server, bad plugin or heavy world.
- It does not stop cheating, griefing or account abuse.
- It cannot help if the attack targets something outside the protected network, such as a player's own home connection.
- It is not a substitute for backups, which protect you from a different failure mode.
If your community is a likely target, combine included protection, sensible secrecy and a host that will talk to you during an attack.
Frequently asked questions
What does 40Gbps DDoS protection mean?
It means the protection can absorb and filter roughly 40 gigabits per second of attack traffic. Bigger attacks can still saturate the link, and speed of detection, packet rate handling and filtering accuracy matter as well.
What is the difference between Layer 4 and Layer 7 DDoS?
Layer 3/4 attacks flood bandwidth or exhaust connection handling, while Layer 7 attacks send requests that look legitimate to overload the application itself, which makes them harder to filter.
Can someone DDoS my server if they only have my IP address?
They can aim traffic at it, which is why hiding the IP helps. Protection in front of the IP is what keeps that traffic from reaching your server.
How do I know if my game server is being DDoSed?
Look for everyone disconnecting or lagging at once without a matching CPU or memory spike. Check your host's graphs, then contact support with the time window.