The structural limit every plugin shares
This isn't about which plugin is best. Sonar, LimboFilter, nAntiBot — pick your favorite; the ceiling is the same. A plugin runs inside your server or proxy, which means the connection it's inspecting has already been accepted by your kernel, given a session by your proxy, and parsed by your CPU. The verification logic can be brilliant, and it still only gets to run once the connection is on your box, spending your resources. That's fine right up until the attack is bigger than your box.
Where a plugin antibot wins
- Cost — the best ones are free. Sonar is GPL-3.0 with no player cap; nAntiBot is free; LimboFilter is free. On your own hardware, that's zero marginal cost.
- Simplicity — no DNS change, no external network in your path, nothing else to trust. It runs where your server runs.
- Good enough for most servers — if you can absorb the connection volume of the attacks you actually get, a plugin holds and you never need anything upstream.
- A strong second layer — even behind an edge, a plugin is useful for verifying whatever reaches your backend.
Where a plugin antibot can't help
Two hard walls, and no plugin gets past either, because both happen before your software runs:
- Volumetric floods — if your uplink is 10 Gbps and the flood is 11 Gbps, the pipe is full and the packets never arrive to be filtered. A plugin can't inspect traffic that never reached it. Absorption has to happen upstream, on a network bigger than the attack.
- Accept-loop exhaustion — a Layer-7 join flood large enough to saturate your proxy's accept path consumes the connection slots before verification runs. Good antibots handle 10–20k conn/s per thread; a cheap 1 Gbit+ flood exceeds that. The bots that would have failed the check have already cost you the resource that mattered.
This is the same reason people run edge DDoS protection at all, and it's why some plugin-based antibots exist mainly to *signal* a separate network layer rather than do the filtering themselves — the plugin knows it can't win the fight alone at scale.
What the edge does differently
- Filters before your box — connections are inspected at a PoP near the player; bots never allocate a slot, thread or login event on your hardware. See the full pipeline.
- Absorbs volume your machine can't — Layer-4 floods hit 500+ Tbps of anycast capacity, not your uplink; the origin IP is never exposed to aim at.
- Verifies without publishing the test — CryoLimbo runs a proprietary, per-session-randomized gauntlet, so bypass bots written against open plugin checks don't automatically pass.
- Layers identity and reputation — AntiVPN, ASN/datacenter risk scoring, stolen-account detection and fingerprint bans, which a physics-only plugin doesn't do.
- Preserves real IPs — the true client address reaches your backend via PROXY protocol, so bans and geo tooling keep working.
At a glance
| Runs where | Plugin: on your server/proxy. Edge: upstream, before your box |
| Acts when | Plugin: after the connection is accepted. Edge: before it reaches you |
| Volumetric floods | Plugin: can't help (pipe fills first). Edge: absorbed at 500+ Tbps |
| Ceiling | Plugin: your uplink + accept loop (~10–20k conn/s/thread). Edge: the network's, not your box's |
| Bypass resistance | Plugin: bounded by public/static checks. Edge: closed, randomized, multi-layer |
| Cost | Plugin: free (your hardware). Edge: free tier, then by player slots |
| Best used as | Plugin: on-box layer, enough alone at small scale. Edge: first line for scale and bypass resistance |
The rule of thumb
If your server absorbs the attacks you actually get, run a free plugin and stop there. If the flood outgrows one machine, if a volumetric attack fills your pipe, or if bypass bots start slipping through, you need the edge — and you can keep the plugin behind it as a second layer. Arvoris' free tier plus a free plugin is a complete two-layer setup for zero cost.
Common questions
What's the difference between an edge antibot and a plugin antibot?+
A plugin antibot runs on your server or proxy, so it inspects connections after your hardware has already accepted them. An edge antibot runs on a separate network in front of your server, so it filters connections before they ever reach your box. Same job — verifying that a connection is a real player — at a different point on the path. The location is the whole difference: a plugin fights bots on your hardware; the edge fights them upstream of it.
Are plugin antibots bad?+
No — plugins like Sonar are excellent, free, and enough for many servers. The limit is structural, not quality: a plugin can only act after the connection is on your box, so it's bounded by your uplink and your proxy's accept loop. For attacks your machine can absorb, a good plugin is the right, free answer. For attacks bigger than one machine, you need filtering upstream.
When do I need an edge antibot instead of a plugin?+
When the connection volume of your attacks exceeds what a single machine can accept, when a volumetric flood fills your uplink before any software runs, when bypass bots start passing your plugin's published checks, or when your host null-routes you during attacks. Below those thresholds, a plugin is fine. Above them, no plugin can help, because the packets never arrive to be filtered.
Can I run both an edge antibot and a plugin?+
Yes, and it's the strongest setup. The edge absorbs the volume and catches most bots upstream; the plugin acts as a second layer for anything that reaches your backend. Since Sonar is free and Arvoris has a free tier, running both costs nothing but a DNS change. Defense in depth applies to antibots the same way it applies to everything else.
How many connections per second can a plugin antibot handle?+
Good ones top out around 10–20k connections per second per thread, so total capacity scales with core count and how much CPU your actual game servers leave free. That sounds like a lot until you learn a 1 Gbit+ Layer-7 flood is cheap to rent and can saturate a single box's accept path well before the detection logic runs. That gap between what's cheap to send and what one machine can accept is exactly the case for the edge.
Put an edge in front without removing what you run today: create a free network, point a test hostname at it, and keep your plugin on the backend. Move your main record only once you've watched what reaches your server drop.