These pages exist because most explanations of DDoS terminology are written for network engineers protecting web servers. Minecraft is a different problem: the traffic is a stateful game protocol, the attacks target the join path rather than the pipe, and the fix has to understand both. Definitions below are written for that context.
All terms
Layer 7 DDoS attack
L7 attack · application-layer attack
A Layer 7 DDoS attack floods the application protocol itself — for Minecraft, valid handshakes and logins — so every packet looks legitimate to anything that only inspects the network layer.
Layer 4 DDoS attack
L4 attack · network-layer attack
A Layer 4 DDoS attack floods the transport layer with connections or raw packets, aiming to exhaust bandwidth or connection-tracking state before the application layer is ever reached.
Join flood
login flood · bot attack · connection flood
A join flood is a Minecraft attack in which thousands of fake clients complete valid handshakes and attempt to join, exhausting connection slots and main-thread time rather than bandwidth.
SYN flood
TCP SYN attack
A SYN flood opens huge numbers of TCP connections without completing them, exhausting the target's connection-tracking state so legitimate connections can no longer be accepted.
UDP reflection attack
amplification attack · reflection attack
A UDP reflection attack sends spoofed requests to third-party servers so their much larger replies are aimed at the victim, multiplying the attacker's available bandwidth.
PROXY protocol
haproxy protocol · real IP forwarding
PROXY protocol is a small header prepended to a forwarded connection that carries the original client's address, letting a server behind a proxy see real client IPs instead of the proxy's.
Anycast
anycast routing · anycast network
Anycast announces one IP address from many locations simultaneously, so traffic reaches the nearest site — which both shortens routes and divides a DDoS flood across every location at once.
Null route
blackhole · RTBH · blackholing
A null route discards all traffic destined for an address, protecting the surrounding network at the cost of taking the target completely offline — finishing the attacker's job for them.
Under Attack Mode (UAM)
UAM · attack mode
Under Attack Mode is an automatic state in which a mitigation system tightens its thresholds and routes new joins through verification once attack indicators exceed a configured level.
Limbo server
limbo · verification server · holding server
A limbo server is a lightweight holding world that suspicious joins are routed into so they can be verified as real clients before ever reaching the production backend.
Minecraft handshake
handshake packet · protocol handshake
The Minecraft handshake is the first packet of any connection, declaring protocol version, the requested hostname and whether the client intends to ping or log in.
Server list ping (MOTD)
MOTD ping · status ping · status request
A server list ping is the status request that populates a server's MOTD, icon and player count in the multiplayer menu — and a common vector for cheap, high-rate floods.
Bypass bot
antibot bypass · bypass client
A bypass bot is a Minecraft bot engineered to defeat a specific antibot by behaving normally on every metric that antibot measures.
Client fingerprint
fingerprinting · connection fingerprint
A client fingerprint identifies a Minecraft client by how it behaves and what it sends, rather than by its IP address, so it remains stable when the attacker changes addresses.
Residential proxy
residential IP · proxy network
A residential proxy relays traffic through real consumer internet connections so attack traffic presents an ordinary home IP address instead of a datacenter one.
Datacenter IP
hosting ASN · datacenter range · cloud IP
A datacenter IP belongs to a hosting or cloud network rather than a consumer ISP — an origin real players rarely use and automated traffic frequently does.
Rate limiting
rate limits · connection throttling
Rate limiting caps how many connections, joins or requests a given source may make within a time window, dropping or delaying the excess.
TCP starvation
connection exhaustion · slowloris
TCP starvation exhausts a target's available connections by opening many and keeping them alive while sending as little data as possible, consuming capacity rather than bandwidth.
Geo-steering
geo routing · geographic load balancing
Geo-steering routes each player to the nearest healthy backend for their location, letting one network serve multiple regions at local latency.
Scrubbing center
scrubbing · clean pipe · traffic scrubbing
A scrubbing center filters attack traffic out of a redirected traffic stream and forwards the clean remainder to the origin.