Hosting providers sell DDoS protection in one of four tiers, and the marketing language for all of them sounds identical. In practice the gap between ‘we mitigate DDoS’ and ‘we null-route your IP at the first spike’ is the difference between a playable community and a dead server for hours. This article maps the tiers to what they actually stop, quantifies the detection window you should expect, and gives you the questions to ask before you sign.
Tier 1: Null-Routing
The cheapest configuration sends your traffic to a black hole the moment a threshold is crossed. It protects the provider’s network and nothing else. Expect a detection window of one to five minutes and a recovery window that depends on a support ticket. For a community server this is effectively an outage. If your provider’s documentation mentions an automatic blackhole trigger with no mention of scrubbing, you are on tier one regardless of the words used.
Tier 2: On-Demand L3/L4 Scrubbing
An on-demand setup detects an anomaly, announces your IP into a scrubbing centre via BGP, and filters packets there. It stops volumetric floods well, but the diversion takes time: typically 20 to 120 seconds to detect, plus 10 to 60 seconds to complete the route change. Players see a lag spike and often a disconnect during that window.
| Metric | Null-route | On-demand L3/L4 | Always-on L3/L4 | L3/L4 + L7 |
|---|---|---|---|---|
| Detection window | 60-300 s | 20-120 s | 0 s | 0 s |
| Added latency | n/a | 0.5-2 ms while scrubbing | 0.2-1 ms always | 0.5-3 ms always |
| Stops 10 Gbps UDP flood | No | Yes | Yes | Yes |
| Stops gameplay-shaped flood | No | Partly | Partly | Yes |
| Player disconnect risk | High | Medium | Low | Low |
Tier 3: Always-On L3/L4
Always-on routes all your traffic through the scrubbing path permanently. There is no detection window and no diversion spike, which matters enormously for game servers where a 90-second disconnect drops every player and can corrupt a raid. The cost is a permanent small latency increase, usually 0.2 to 1 ms, and a hard dependency on the provider’s filter quality. Always-on scrubbing with a lazy ruleset will block legitimate traffic continuously; test it with real gameplay before you trust it.
Tier 4: L3/L4 Plus Layer 7
Layer 7 mitigation understands your protocol. For game servers this means it can distinguish an A2S query flood from legitimate queries by inspecting the request shape, and can apply per-title signatures rather than blunt packet limits. This is the only tier that reliably stops low-volume, high-effectiveness attacks that mimic gameplay. Note the limitation: most L7 engines are built for HTTP, so verify the provider supports your game’s UDP protocol specifically, not just ‘layer 7 protection’ in general.
When Provided Mitigation Is Not Enough
- Attack exceeds per-IP capacity. If the flood is larger than the provider’s per-destination limit, no amount of ruleset tuning helps; you need a provider with higher per-IP capacity or a fronting CDN/anycast layer.
- Attacker targets your DNS. Point your domain at a DDoS-resilient managed DNS service so the game IP is the only exposure.
- Attacker targets your backend. Keep the database and RCON on private networking; a public management port is a second attack surface the scrubber never sees.
- Advertising your IP. Publish your server through a proxy or a hosted listing service where the title supports it, so the origin address stays undocumented.
A Pre-Signature Checklist
- Get per-IP scrubbing capacity in Gbps and Mpps, in writing.
- Confirm always-on versus on-demand and measure the real detection window with a schedule-controlled test.
- Ask whether the ruleset can be tuned per protocol and per title.
- Confirm the scrubbing path is withdrawn automatically when clean.
- Check that un-null or un-scrub requires no ticket.
- Ask what happens to latency during normal operations, not just during an attack.
Matching Tier to Workload
Not every server needs tier four. A private, whitelisted server for ten friends can live happily on tier two, because the attack surface is small and the consequence of a brief outage is low. A public community with a Discord full of rivalries, streaming events and seasonal wipes needs tier three at minimum, and tier four if you run competitive ladders where disconnects decide results. A high-traffic web storefront with a gaming front page sits between the two: tier three absorbs the volumetric noise, while a CDN handles the HTTP layer that L7 engines are actually designed for.
The selection rule is simple: identify the attack your community can realistically attract, add a 3x margin, and buy the tier whose per-IP capacity exceeds that number with room for growth. Document the decision so that when an incident happens at 2 a.m., whoever is on call knows what protection is in place and what the escalation path look like.
Protection tier should be a line item next to CPU, RAM and bandwidth when you compare dedicated web hosting servers for gaming, and it belongs on the same shortlist as your bare-metal server choice. A node with outstanding specs and tier-one protection is a node that will spend its first attack offline.
Leave a Reply
You must be logged in to post a comment.