"DDoS protection included" appears on almost every hosting price page, and it means something different on each one. Some of those somethings are real. One of them is the host switching your server off. This is what the attacks are, what the defences are, and the three questions that separate the two.
Three kinds of attack
Volumetric. The attacker sends more traffic than your connection can carry. UDP floods, amplification attacks that bounce small requests off open DNS or NTP servers to produce large replies. The server is fine; the pipe to it is full. Measured in gigabits per second.
Protocol. The attacker exhausts the state tables in servers, firewalls and load balancers. SYN floods are the classic: thousands of half-open connections that never complete. The pipe has room; the device in front of the server does not.
Application. The attacker sends requests that look like real users: page loads, searches, logins, at a rate the application cannot sustain. Small in bandwidth, expensive for the server. The hardest to filter, because telling an attacker from a customer takes understanding of the application.
A game server gets a fourth flavour: floods aimed at the game's own protocol, timed for wipe day or a tournament.
What scrubbing does
Mitigation runs in four stages. Detection: something watches traffic and notices the pattern change. Diversion: traffic for the attacked address is routed through scrubbing capacity. Filtering: the floods, the malformed packets and the obvious bots are dropped. Return: the clean remainder is delivered to the server.
Always-on scrubbing keeps every packet on that path all the time. There is no gap at the start of an attack, at the cost of some capacity and money. On-demand scrubbing diverts only once an attack is detected, which leaves a window, typically from thirty seconds to a few minutes, in which the server is down before protection starts. Cheaper, and the window is exactly when a game server loses its players or a store loses its checkout.
What is not protection
Null-routing, or blackholing, is the host announcing that your IP no longer exists so the attack traffic stops arriving at their network. Your server is now unreachable by anyone. The attack has succeeded, with the host's help. Some hosts describe this as "automatic DDoS mitigation". Ask.
Blocking IPs by hand is also not protection. A botnet uses tens of thousands of addresses and rotates them.
Three questions for any host
- Is the scrubbing always-on or on-demand, and if on-demand, what is the detection time?
- What happens above the protected capacity: filtering, rate limiting, or null-route?
- Who operates the scrubbing: the host, or an upstream the host resells?
A host that answers all three plainly has real protection. A host that answers with "enterprise-grade" has a brochure.
How URLStart does it
Every server, VPS or dedicated or colocated, sits behind always-on scrubbing on URLStart's own network, with no protection tier to buy. Gaming plans add game-protocol filtering and port isolation, because a Rust or Minecraft flood looks different from a web flood. Above the scrubbed capacity, traffic is rate-limited rather than null-routed. The DDoS protection page has the detail.
Questions we get asked
Does a small site need DDoS protection? Attacks are cheap to launch and often aimed at random. The question is whether you want protection to be a thing you buy after the first one.
Will scrubbing slow my site? Always-on scrubbing on a well-built network adds no measurable latency. Diverting traffic halfway across the world to a third-party scrubbing centre can.
Can you stop application-layer attacks? The network layer stops the floods. Application attacks also need the application's help: caching, rate limits on login and search, a web application firewall. We help set those up.
What should a game server owner ask? Whether the protection understands the game's protocol, and whether other customers on the same IP range can be affected by an attack on you. Port isolation answers the second.
Do you charge for an attack? No. Scrubbing is in the price and an attack is not a billable event.
