What it is
A Layer 7 attack operates at the application layer of the OSI model — the layer where the Minecraft protocol lives. Instead of raw packet volume, the attacker sends protocol-correct traffic: complete TCP handshakes, valid Minecraft handshake packets, plausible usernames, correct protocol version numbers. Every individual connection is well-formed. The damage comes from the rate.
Why it matters for Minecraft
Minecraft is unusually exposed to Layer 7 attacks because a join is expensive and a connection slot is finite. A few thousand bots joining per second will consume slots, threads and login events long before they consume bandwidth — which is why a server can be knocked offline by an attack measured in tens of megabits. Bandwidth-based mitigation never triggers, because by volume nothing unusual happened.
How it is actually stopped
Only by reading the protocol. A filter has to parse the handshake, evaluate the hostname requested, judge the join rate per source and per network, score the origin, and hold anything suspicious for verification instead of guessing. That is the whole argument for protocol-aware filtering — a packet counter cannot do it, because at the packet level there is nothing wrong.
Common questions
What is the difference between a Layer 7 and a Layer 4 DDoS attack?+
Layer 4 attacks target the connection: SYN floods, spoofed packets, raw connection rate. They can be measured without understanding what the traffic says. Layer 7 attacks target the application: for Minecraft, the join path. A Layer 4 filter can tell you a million connections arrived; only a Layer 7 filter can tell you whether they were players.
Can a firewall stop a Layer 7 attack on a Minecraft server?+
Not reliably. A firewall matches on addresses, ports and packet shape, and a Layer 7 join flood is correct on all three. It can rate-limit by source IP, which helps against crude attacks and fails against distributed ones, because each individual address stays under the threshold.