What it is
When a client shows your server in its list, it opens a connection, sends a handshake with the next-state field set to status, and receives JSON describing your MOTD, version, icon and player counts. It then usually measures latency and disconnects. The whole exchange is short and requires no authentication.
Why it matters for Minecraft
Because it costs the requester almost nothing and costs you real work — building the response, reading the player count, serving the icon. At normal rates this is irrelevant. At attack rates it becomes a quiet CPU drain that also corrupts your metrics, since ping traffic inflates apparent connection counts without a single player joining.
How it is actually handled
By answering from cache at the edge rather than forwarding to your server. The status response changes rarely, so serving it upstream absorbs the flood entirely while real players still see an accurate list entry. Caching correctly means keying on the exact protocol version — a client that receives the wrong version's response will show the server as incompatible.
Common questions
Do ping floods actually take servers down?+
Rarely alone, and they are almost always present alongside something worse. Their real effect is CPU drain and misleading metrics, which makes diagnosing the accompanying [join flood](/glossary/join-flood) harder.
Why does my player count look wrong during an attack?+
Because status requests and connection attempts are being counted as activity. Once pings are served from edge cache and bot joins are filtered upstream, the count reflects players again.