I am going to make a game server which involves port forwarding, I also heard that people can DDoS attack. When they DDoS attack, what is it that they attack, the internet or the computer? Also, what is a DDoS attack anyway? How can I protect against them?

closed as too broad by forest, Xiong Chiamiov, Steffen Ullrich, Xander, schroeder Mar 10 '18 at 19:57

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    The question in the title and the text are not the same. Do you want to know how to protect agains DDoS or what a DDoS attack is? – Anders Oct 14 '16 at 7:11
  • 3
    Sailorman - please read the huge range of questions we already have here on ddos. They will answer a lot of your questions. – Rory Alsop Oct 14 '16 at 11:52

In normal TCP communications, your server* is quietly listening on the network, expecting packets with the SYN flag set. These SYN packets come from clients initiating a request to open a new socket connection. The server makes note of the open connection request, saves the source IP address of the sender (which is contained inside the packet), and sends a response containing both the SYN and ACK flags set back to the source IP address. When the client receives the SYN/ACK packet, it responds with an ACK packet. When your server receives the ACK, the socket is fully connected and the applications can start sending data to each other.

A Distributed Denial of Service (DDoS) attack is a network-based attack, where dozens or thousands of hacked computers are running malware that sends thousands or millions requests every second to the open port on your network. A SYN Flood attack is where the malware sends only SYN packets. The hacked computers write a random address in each packet as the source IP address. Your server doesn't know they're not valid addresses, so it just tries to reply to them.

But the attacking computers are running malicious code. They never get the response (which your server politely sent to the random source address), and they never send the ACK packet your server is waiting for. This leaves the partially open socket just laying around in your server's memory, waiting for the request to complete. Your server has only a finite capacity as to how many partially open sockets it can keep around; and only a finite amount of time to respond to them. It cannot handle a queue of a million half-open sockets.

But since your server trusts that all socket requests are coming from legitimate users, it tries its best to respond to them all, because that's what it's supposed to do. It quickly fills up under the flood of traffic. If you're lucky, it sends RST packets back to everyone trying to connect once the queue is full, politely denying them service. If you're unlucky, your network card or server chokes on the overload and crashes. Either way, your legitimate users are caught in the flood, and can't get to your server, either -- thus they are "denied service" (hence the name).

Unfortunately, there is very little that you as a server owner can do about a DDoS attack. The packets all come from random addresses, and don't contain the actual IP address of the computer that sent them, so there's no easy way to follow them back to the attackers. With enough money, you can hire a company to help keep your site up through various hosting and network tricks. And there are network appliances that make an attempt to identify and exclude SYN flood packets. But even they have their limits, as Brian Krebs found out a few weeks ago.

* I wrote server to keep the description simple, but this attack will flood any network device that is listening on that port. If you're using a typical home router and port forwarding to your server, the router's more limited memory will be flooded, and the router will likely crash before your server does.

  • What happens when the router crashes? What can I do once it crashes. – LilVinny Oct 14 '16 at 11:39
  • Your router will probably reboot itself after a crash; but you might have to reboot or reset it manually, or even unplug/replug the power cord. But as long as the DDoS attack continues, you'll be offline until it's over. And this is all based on the idea that someone would go to the trouble of DDoSing your private gaming server, which is a very unlikely occurrence. I wouldn't spend any more time worrying about it unless it actually happens to you. – John Deters Oct 14 '16 at 19:25
  • @JohnDeters You would be very surprised how bitter gamers can get and what they'll resort to. DoS attacks against personal networks is not uncommon (at least for video games that involve P2P connections). After all when you're salty about losing in a game, it's the next best thing after reaching your hand through the screen and punching someone in the face. – forest Mar 10 '18 at 2:17
  • Yeah, I wasn't thinking about vengeful gamers. And since you can buy DDoS for hire on the dark web, it now only takes an idiot with a bitcoin to make life miserable for the home-hosted game server. Sigh - never underestimate human stupidity... – John Deters Mar 10 '18 at 2:38
  • FWIW, all those DDoS for hire onion sites are scams (as are the hacking services, hitmen, etc). Of course, there are quite a few DDoS for hire sites outside of the "dark web" that market themselves as stress testing services. – forest Mar 10 '18 at 3:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.