What it is
Rather than flooding, the attacker opens connections and keeps them alive as cheaply as possible — sending a byte occasionally, completing a handshake and stalling, or advertising a tiny receive window so the server holds data it cannot deliver. Each connection costs the attacker nearly nothing and costs the server a slot and some state.
Why it matters for Minecraft
Connection capacity is finite and Minecraft servers hold state per connection. An attack that occupies slots without ever becoming a player crowds out real joins while looking like almost no traffic at all. It is a favourite precisely because it evades every volume-based alarm.
How it is actually stopped
Timeouts that are strict about connections which do not progress, per-source connection budgets, and moving the whole problem upstream so the slots being exhausted are the edge's rather than your server's. A handshake that never advances to login is a strong signal on its own — a real client always progresses.
Common questions
Is this the same as a SYN flood?+
No. A [SYN flood](/glossary/syn-flood) never completes the connection and is stopped in the kernel. TCP starvation completes it and then does nothing, which means the connection is real and has to be judged on behaviour rather than on packet validity.
Why does my server show high connections but low traffic?+
That pattern is close to diagnostic of a starvation-style attack. Volume-based monitoring shows nothing while capacity quietly fills.