Symptom table: the three attack types
| Volumetric flood (L3/4) | Everyone lags or times out simultaneously; server may be fully unreachable. Console: often silent. Host graphs: inbound bandwidth spikes hard (Mbps/Gbps), sometimes followed by your host null-routing the IP. |
| Connection flood | Joins hang, new players can't get in, online players may survive a while. Console: rapid connect/disconnect spam from many IPs. Host graphs: connection count and packets-per-second spike while bandwidth looks modest. |
| Ping/join flood (Minecraft L7) | Server list entry times out or shows garbage; fake players flood the slots. Console: bursts of status pings or bogus usernames joining. Host graphs: subtle — this attack is cheap in bandwidth, which is why generic filters miss it. |
Rule out the ordinary suspects first
- Bad plugin or world lag — run `/tps` and a timings/spark report. Low TPS + flat network = internal. A DDoS doesn't lower TPS from valid gameplay; it starves the network path.
- Overloaded shared host — if lag is constant-ish, worst at peak hours every day, and other customers on the node report the same, you're fighting for shared CPU, not an attacker. Attacks are abrupt and time-boxed (booter sessions are sold in minutes).
- Your own connection — ask in Discord. If only you lag and others are fine, it's your ISP, not the server.
- Host maintenance or upstream issues — check your host's status page before declaring war.
The strongest signals it really is an attack
Timing and motive. Booter attacks cost about $5 and are almost always personal: they land minutes after a ban, mid-tournament, or during your launch weekend — exactly when disruption hurts most. Abrupt edges: performance falls off a cliff at a specific timestamp and often recovers just as suddenly when the purchased attack window ends. Graph divergence: your host's network/connection graphs spike while in-game TPS was healthy up to the moment players dropped. And the near-certain confirmation: a ransom or gloating message in Discord. (If you're wondering how someone with no skills is doing this, read what a booter is.)
What confirming it means
A confirmed attack tells you two things. First, your real IP has leaked — it's in a booter somewhere, and it will be reused; getting a fresh IP helps only if the new one is never exposed. Second, nothing installable on the server will fix it — mitigation has to happen on a network big enough to absorb the flood before it reaches your host. That's the Arvoris model: players connect to a 500+ Tbps anycast edge, Cryo filters at the Minecraft protocol level, and only clean traffic reaches a backend address that's no longer public. The free plan covers up to 15 players with the full pipeline, so diagnosis can turn into protection the same afternoon — the emergency playbook is in How to stop a Minecraft DDoS attack.
Common questions
How do I know if my Minecraft server is being DDoSed or just lagging?+
Check two numbers: TPS (run /tps on Paper/Spigot) and your host's network graph. Low TPS with flat network traffic = internal problem (plugins, world gen, too little RAM). Normal TPS but players timing out, plus a network or connection-count spike on the host graph = attack. Attacks also start and stop abruptly; organic lag builds gradually.
What does a DDoS attack look like in the server console?+
Depends on the type. Volumetric floods often show nothing in-console — the server just becomes unreachable. Connection/join floods show rapid streams of connect–disconnect lines, often from many different IPs, or fake usernames joining and leaving. Ping floods may show nothing but make the server list entry time out.
Can one player cause DDoS-like lag?+
A single player can't flood your bandwidth, but crash exploits, chunk-loading abuse (flying fast in unexplored terrain) or item-stacking machines can tank TPS in ways that feel similar. The tell: TPS drops, network stays flat, and it stops when that player leaves or the mechanism is removed.
Everyone got disconnected at the same time — is that a DDoS?+
It's a network-path event, but not necessarily an attack: host maintenance, a network blip, or a crashed proxy do the same. It's evidence of attack when it repeats, correlates with a traffic spike on the host's graphs, or happens right after you upset someone. One mass-disconnect alone isn't proof.
I've confirmed it's an attack — what now?+
Don't pay any ransom, don't restart in a loop, and move behind a filtering edge — that's the only fix that holds. The step-by-step is in [How to stop a Minecraft DDoS attack](/guides/how-to-stop-a-minecraft-ddos-attack); the free Arvoris plan is enough to get protected today.
If the symptoms above match, don't wait for the second wave — get behind the edge now; setup is one DNS record and about five minutes.