DDoS Mitigation Capacity Maths for Game Servers: Gbps, Mpps and Filtering Layers

UDP floods and reflection attacks do not care about your CPU clock speed. They care about whether the packets even reach a filter capable of dropping them without saturating an uplink. Sizing mitigation correctly means working in three separate units — gigabits per second, packets per second, and connection rate — because a 400 Gbps volumetric flood and an 8 Mpps game-query flood stress entirely different parts of the path. Providers publish one number and hide the other two, which is why so many operators discover their real ceiling only during an incident.

Know the three dimensions of an attack

Bandwidth is the number most often quoted, and the least often decisive. A modern reflective UDP flood can push hundreds of Gbps toward a target, but a well-built scrubbing centre absorbs that at its edge before it ever touches your rack. What matters more is packets per second: small UDP packets consume filter lookup slots and hardware forwarding entries. A 1 Gbps stream of 64-byte packets is around 1.5 Mpps, which stresses a firewall far harder than a 10 Gbps stream of large packets.

• Gbps — total link capacity the scrubbing tier must forward. Ask for the committed clean-pipe size, not the marketing peak.
• Mpps — packet-rate ceiling of the filtering device. Query floods and amplified DNS responses live here.
• Connection rate — new-flows-per-second limit for TCP-based game traffic. SYN floods exhaust state tables before bandwidth.

Detection windows and BGP diversion

Most carriers detect attacks by sampling flow telemetry and announcing a diversion route when a threshold is crossed. That detection window — typically 10 to 60 seconds — is the period your server takes the full force of the attack. For a game server, even 15 seconds of unmitigated flood means disconnected players and a crash of the tick loop. Ask your provider whether they offer an always-on baseline filter or only on-demand diversion. Always-on filtering costs more but removes the detection lag entirely for known attack signatures.

For any serious competitive or high-traffic deployment, the mitigation topology deserves the same scrutiny as the hardware. The guidance in our dedicated infrastructure planning notes treats the network path as part of the server build, not an afterthought, and that framing is correct.

What actually survives a UDP flood

Sizing maths you can actually apply

Take your peak legitimate traffic in Mpps at the busiest hour — for a 64-slot shooter with UDP query traffic this is often 200–600 Kpps. Your filter must handle at least ten times that to survive a concentrated burst. If your provider’s clean-pipe is quoted in Gbps only, ask for a documented Mpps figure. A filter that forwards 40 Gbps but drops at 2 Mpps will collapse on a 3 Mpps query flood that never exceeds 2 Gbps.

• Measure legitimate peak Mpps with a packet capture at the NIC, not from the game console.
• Add headroom of 10x for the filter, and confirm the number in writing.
• Test with a simulated flood before launch — a controlled UDP burst from a test host reveals the real drop-off point.
• Keep a null-route playbook ready for the worst case, so a single vexatious host does not take down a whole network.

Operational discipline beats hardware

Mitigation is only half the battle. Log the attack, record peak Gbps and Mpps, and correlate with player reports so you build a picture of who attacks you and when. A game server that survives an incident but loses its save file to an unclean shutdown has not really survived. Pair your network defences with clean shutdown handling, and revisit the capacity plan quarterly as player counts grow. The operators who come through attacks intact are the ones who measured their ceilings before they needed them — the reference material at bestdedicatedwebhostingserver.com is a reasonable starting point for that planning.