Our very first firewall, in 2009, understood exactly one thing: the Counter-Strike query protocol. Seventeen years later the same principle runs the filter - judge traffic by what the packets actually say, never by the port they arrived on. For game hosting that is not a preference, it is the only thing that works.
Both are UDP, both are small packets at high rate to a high-numbered port, and neither completes a handshake a firewall can validate. A rule that stops the flood by pattern will stop the players with it.
We measured a single flood spread over 209 destination ports with the busiest carrying 0.5% of it, and payload bytes with full uniform entropy at every offset. No port rule and no signature can see that - only per-destination volume can.
Scrubbing that reroutes traffic through a distant centre adds tens of milliseconds. For a shooter that is worse than the attack, and players leave over it.
A2S query floods against Source servers, RakNet offline-message floods against Minecraft, FiveM getinfo storms - each has its own shape, and we have the captures for all of them.
Filtering is in the forwarding path at all times, so the route does not change when an attack starts. The latency you measure on a quiet evening is the latency during a flood - there is no diversion event and no BGP convergence to wait out.
Source engine, RakNet and FiveM traffic are recognised from their bytes. Our incident captures identify these payloads by signature independently of port, which is how a flood on port 27015 is separated from players on port 27015.
Attacks against game hosting increasingly spread across an entire allocation. Prefix-level and host-level budgets are evaluated together, so a flood aimed at 256 servers at once is caught by the aggregate.
Launcher, store, forum and panel sit behind the Layer 7 service with automatic certificates and challenges only when a session looks wrong, while the game ports stay on pure network filtering where latency matters.
ISO 9001ISO 27001PCI-DSSGDPRNIS2 The mitigation is one layer. The same network sells the layers around it - and a stack bought from one operator has nobody in it to blame somebody else.
An IX-heavy blend with direct PNI ports into the access networks players actually sit on, and path selection measured continuously for latency - because a cheap mix is audible in the ping. The transit page →
Private Layer 2 between sites for state replication, matchmaking backends and internal tooling - or a wavelength when you want the packet layer entirely yours. Off the public internet either way. EVPN-MPLS transport →
NIC selection, queue, RSS and NUMA setup for packet-heavy game workloads - the same work we do on our own filtering fleet - configured, documented and supported after handover. How an engagement runs →
Protection for other sectors
This site sets zero cookies - no analytics, no trackers, no profile of you. The only third-party requests are the fonts, served by Google Fonts, and the spam check on the contact form. Everything else stays between your browser and our network - the full privacy note.