Glossary

UDP reflection attack

How small botnets produce terabit floods. The attacker never sends the traffic that hits you — thousands of innocent misconfigured servers do, on their behalf.

What it is

The attacker sends a small UDP request to a public service — DNS, NTP, memcached, and others — but forges the source address so it reads as the victim's. The service replies to the victim. Because the reply is much larger than the request, the attacker's bandwidth is multiplied by the amplification factor, which for some protocols runs into the thousands.

Why it matters for Minecraft

It is the mechanism behind most of the very large floods a Minecraft network will ever see, and it is purely volumetric — it does not touch the game protocol at all. The traffic is obviously junk, so the only question is whether it lands somewhere with enough capacity to absorb it, or on a 10 Gbps uplink that fills instantly.

How it is actually stopped

Capacity and filtering upstream. Reflected traffic is easy to identify — it is UDP from services you never queried — so dropping it is not the hard part. Having somewhere to drop it that is bigger than the attack is the hard part, which is why absorption happens on an anycast network rather than at your host.

Common questions

Why can't I just block the source IPs?+

Because the sources are legitimate third-party servers, not the attacker, and there are millions of them. Blocking them individually is endless, and the traffic still consumed your uplink on the way to being blocked.

Does Minecraft's use of TCP protect me from UDP floods?+

No. The flood does not need to reach a listening service to do damage — it only needs to fill the link your server sits behind. Your game port being TCP is irrelevant to a saturated uplink.

Related reading

Layer 4 DDoS attackAnycastNull route

Your next attack is already scheduled.
Be behind the edge when it lands.

We take care of security so you can branch out. Free plan, no card, one DNS record — if it doesn't hold, you lost five minutes.