0

I may not understand how DDoS attacks work at this point, but Im just wondering if this would work for a game server?

IF each time a new connection is attempted and the packet or connection type is not similar to that of a normal player, then block the connection?

I dont see any reason for the server to allow connections that are not needed to play the game. Only 1 port would be open. The only downside I see is that the CPU would be put under a lot of stress with large attacks.

But for the most part, wouldn't this work well?

I may be completely wrong and off-base, so i'm just posting here to find out.

  • Are you proposing that the game implement an alternative syn/ack sequence? – wireghoul Jan 17 '15 at 13:02
3

A DDoS attack does not necessarily saturate the network capacity, any resource which can be exhausted to result in the application being unable to serve requests can be used to achieve a DoS.

As you say:

The only downside I see is that the CPU would be put under a lot of stress with large attacks.

The CPU is definitely a resource that can be exhausted to achieve a DoS. In the case of a game server this is probably a particularly common scenario given that the game server probably performs complex server side operations.

not similar to that of a normal player

I suspect that determining what is not normal is another very challenging and subjective task. I imagine game developers expend considerable effort developing reasonable rate limits for computationally expensive operations to balance DoS prevention with not impacting legitimate game play. However, I doubt they get this balance right 100% of the time, just like developers aren't always able to prevent vulnerabilities and bugs 100% of the time.

0

DDOS attacks are not just against the Server resources they are against bandwidth too. The most recent attacks had bandwidth consumption of up to 1 Tbps.

Blocking IP's is not going to help as the firewall still has to drop large amount of packets/connections from multiple sources and within a short amount of time the server runs out of it's allocated/available bandwidth.

Gaming severs have to accept traffic on certain ports across the internet to make sure users can access them regardless of their location. Most gaming servers have dedicated servers per region.

Script kiddies do not actually log on to gaming servers, they are simply trying to overwhelm the server/bandwidth so legitimate users wont be able to access them.

0

TL;DR Powerful hardware is probably the only defense for full-scale DDoS attacks. Blocking users IP can help, but can also backfire, since actual players might be used in DDoS against you without knowing it. Keep server connection handling fast and lightweight, to avoid adding extra ways they can attack.

First of all, the server must not allow a connection to do anything until it has been authenticated and shown to be a valid user. There is no reason the server should do anything for non-valid connections. Your players must have accounts on your server, and they must login with a password. The server should not do anything with a connection until a they can login successfully. Any expensive handling should only happen after the login has been completed. You could take this one step further, and block the IP address of anybody that makes too many bad login attempts, but this probably wont help much for the reasons below...

Trying to block connections in software will not stop a true DDoS attack. At best it would work in a specific scenario where you have angered a forum of thousands of members, who decided retaliate by spending all day trying to log in to your sever. Plausible, but not an efficient way to attack. Blocking them would reduce the load on your game server if you have a somewhat expensive authentication scheme.

A true DDoS, however, ignores your login protocol. It operates at the lower network layers; before your application ever knows a packet has been received. These types of attacks cannot be mitigated other than by hardware that is powerful enough to withstand more abuse than your attackers can deal out. Special hardware firewalls might help here. The firewall itself can block connections based on it's own logic, but it still has limits. A more expensive firewall might have higher limits, but still probably can't withstand 10 million attackers. Now if your game server is a server cluster in dozens of locations each with it's own expensive router and firewall... it stands a much better chance overall. That might be more cost than any game server is worth, but even modestly priced routers have some traffic filtering.

Blocking connections in your code when your firewall can't might prevent your code from suffering a secondary hit on the processor and memory, and neither can help with network saturation. (You can close your front door to stop people from trampling all over your house, but that does not stop them from crowding your driveway. You could add a gate, but they can swarm the gate. You could build a bigger gate, but enough of them can swarm that too.)

Weather in software or through a firewall, blocking users by IP does have a downside. Imagine if a troll who hates your game decided to create a webpage with a script that makes login attempts to your game. If they upload this page to one of your games forums, any legitimate players who pass by that page will unknowingly be making login attempts. Not only does this cause problems for your server handling these requests... but if your sever blocks them, then you are potentially blocking legitimate players!

So, in closing, make sure you have a proper and efficient login protocol, as good of a router/firewall as you can afford, and that you are very careful about how you block IP addresses, if at all.

  • 1
    A TCP stack without SYN cookies can be killed off easily by a trivial DDoS, no matter how robust the hardware is. If the TCP stack is completely broken an attacker can fill your RAM. And there is no amount of RAM that can sustain a continuous input even from a modest bandwidth. In summary, a good firewall is not only hardware. – grochmal Oct 25 '16 at 1:46
-1

If you read stevens, you'll realise the network socket is defined in part by the source socket port and the receiver socket. So having one open port is not a panacea for the ddos. At this point, what you're trying to balance is the rate at which you can identify and remove resource hogs vs the rate of incoming requests.

It is the classification of the incoming requests that is the tricky part.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.