What it is
Layer 4 is the transport layer — TCP and UDP. An attack here does not care what your server runs. Common shapes are the SYN flood, which exhausts connection-tracking state; UDP reflection, which borrows third-party servers to multiply the attacker's bandwidth; and plain connection floods that simply open more sockets than the target can accept.
Why it matters for Minecraft
Because it is the half that arithmetic decides. If the flood is larger than your uplink, the uplink is full and everything behind it is offline regardless of configuration — the server, its firewall, and every plugin it runs are on the far side of a road that is already blocked. No amount of application-level cleverness helps once the pipe is saturated.
How it is actually stopped
Absorption on a network with more capacity than the attacker can generate, plus kernel-level packet filtering. This is genuinely solved by scale: the traffic is obviously junk, so the only question is whether there is somewhere big enough to drop it. What Layer 4 filtering cannot do is tell a player from a bot — at that layer neither has said anything yet. See Layer 7 for the half that remains.
Common questions
Is a Layer 4 attack worse than a Layer 7 attack?+
Bigger, not worse. Layer 4 attacks reach terabits and Layer 7 attacks rarely need to exceed a few gigabits — but the Layer 7 one is far more likely to actually take a well-protected Minecraft server down, because it survives every filter that only measures volume.
Does hosting DDoS protection cover Layer 4?+
Usually yes, and usually only that. Host-level protection from providers like OVH or Hetzner is built to absorb volumetric floods, which is real and useful. It does not read the Minecraft protocol, so join floods pass through it untouched.