What it is
A join flood sends complete, valid Minecraft login sequences from many sources at a high rate. Each bot performs a real handshake, sends a real login-start packet with a plausible username, and either disconnects or idles. Because the traffic is protocol-correct, the server does exactly what it is designed to do — allocate a connection, spawn a player object, fire login events — several thousand times a second.
Why it matters for Minecraft
This is the attack that ends servers. The cost per bot on your side is enormous relative to the cost on the attacker's side: they send a few hundred bytes, you allocate memory, run plugin logic and load chunks. A flood measured in megabits can exhaust a server with gigabytes of RAM, which is why join floods are cheap to rent and devastating to receive.
How it is actually stopped
By filtering upstream, before a connection slot is spent. Join rate is scored per source and per network, origin reputation is weighed, and anything suspicious is sent to a limbo server to prove it is a real client. Plugins can do a version of this, but they act after the connection has already cost you — which is the edge versus plugin argument in one sentence.
Common questions
How do I know if my Minecraft server is being join flooded?+
Logins arrive far faster than usual, often with randomised or patterned usernames, TPS drops or the server stops accepting connections, and bandwidth looks normal. That last part is the tell: a volumetric attack shows on the bandwidth graph, a join flood does not.
Will a whitelist stop a join flood?+
It stops the bots from playing, not from costing you. The connection, handshake and login are all processed before the whitelist check rejects them, so a large enough flood still exhausts the server. It is a useful emergency measure, not a defence.