DDoS attacks are one of the most common causes of downtime for game server and e-commerce operators. This guide explains what a DDoS attack is, which types exist, how to tell whether your server is under attack, and which protection methods actually work.
DDoS stands for Distributed Denial of Service. The attacker's goal is not to break into your system or steal data. The goal is much simpler: to keep your server so busy that it can no longer serve real users.
Think of it this way: if thousands of people rushed a shop's entrance at once without buying anything, actual customers could not get through the door. A DDoS attack works the same way — your server's bandwidth, CPU or connection table is filled with fake requests.
A DoS attack comes from a single source and is relatively easy to stop: you block the attacking IP and you are done. A DDoS attack is distributed. Traffic arrives from thousands of compromised devices spread across the world — a botnet. These are often poorly secured IoT products, unpatched routers or infected computers whose owners have no idea they are participating.
This distributed structure makes the "block the bad IP" approach useless. You cannot block thousands of addresses one by one, and some of them may share ranges with your genuine users. Effective protection therefore requires a filtering layer that distinguishes traffic by behaviour rather than by source.
Attacks are grouped by the network layer they target. This distinction matters, because protection that works against one group may be useless against the other.
These are far more subtle. Traffic volume is low — it may not even stand out on a graph — but every request causes real work on your server. A conventional firewall treats this traffic as normal visitors.
The practical consequence: an infrastructure offering only volumetric protection is defenceless against Layer 7 attacks. Serious protection must filter both layers.
Some of these signs can also be explained by misconfiguration or a legitimate traffic surge. The distinguishing question is: did traffic increase without any increase in revenue or active users? If yes, you are most likely under attack.
Software firewalls running on the server itself are largely helpless against volumetric attacks, because the packets have already reached your link and filled it. Effective protection requires traffic to be filtered at the network edge, before it reaches your server. This is a capability your hosting provider's infrastructure must have.
To target you, an attacker must first know your IP address. Old DNS records, email headers, SSL certificate transparency logs and error pages are the most common leak paths. Always clean up old A records after migrating a server.
A frequent misconception. Cloudflare's standard plans proxy HTTP and HTTPS traffic. However, MTA, FiveM, Minecraft and TeamSpeak use the UDP protocol — that traffic does not pass through Cloudflare. Even if your web interface is protected, your game port is directly exposed. If you run a game server, protection must be provided at network level by your provider.
Setting per-IP request limits at application level significantly reduces the impact of Layer 7 attacks. limit_req in Nginx and mod_evasive in Apache can be used for this. Define separate, stricter limits for login and API endpoints.
Every open port you do not use is an attack surface. Publicly exposed DNS, NTP and Memcached services in particular make you both a target and a potential weapon in amplification attacks against others. Review your open ports regularly with netstat -tulpn.
You should notice an attack before your customers tell you about it. Define threshold alerts on bandwidth, connection count and response time. Early intervention is the difference between minutes and hours of downtime.
The middle of an attack is the worst time to start planning. Write down in advance who contacts the provider, where users will be informed (social media, Discord) and which services will be temporarily disabled.
All Nubitro VDS, dedicated server, game server and web hosting services run on a DDoS-protected network infrastructure. Protection is active the moment your server is created; you do not need to enable it manually or purchase an additional package.
Because filtering is performed on our own network infrastructure, traffic is not routed abroad to be scrubbed — which means no added latency for your users and players. Given how critical ping is for game servers, this difference matters in practice.
No. DDoS is not a data theft attack; it targets availability. One caveat, however: DDoS is sometimes used as a distraction to mask a different attack. Keep monitoring your security logs during an incident.
A significant share of DDoS attacks come not from professional criminal groups but from competing server owners or banned users. Buying attack capacity is unfortunately cheap and easy today. The size of your site does not protect you.
If the scrubbing centre is abroad, yes — traffic travels to another country, gets cleaned, and returns. If protection is applied on local network infrastructure, this detour does not occur and the effect on ping is negligible.
It helps against Layer 7 and low-volume attacks. But in a volumetric attack, your link is already saturated by the time packets reach your server; the iptables rule may fire, yet your bandwidth is gone. Protection must therefore sit at the network edge.
Anywhere from a few minutes to several days. Short "test" attacks are often the reconnaissance phase of a larger campaign — take them seriously.
DDoS attacks may look technically complex, but the logic of defending against them is simple: stop malicious traffic at network level before it reaches your server. Measures taken on the server itself are complementary but not sufficient on their own. If you run a game server in particular, your provider's ability to filter UDP traffic should not even be negotiable.
If you would like to move your infrastructure onto protected ground, get in touch with our team and we will identify the right solution together.
Turkey (Türkçe) 
