Let the attack come; your server stays up

What is a DDoS attack?

DDoS stands for distributed denial of service. An attacker uses thousands or millions of infected devices, called a botnet, to send a huge volume of fake traffic at one server and push it out of reach. Real users then cannot reach your site, game or service, even though the server itself is healthy.

These attacks are cheap and common, and motives range from business rivalry and extortion to an angry player. Game servers, online shops, exchanges and financial services are hit most. To learn more, read the DDoS protection guide.

Types of DDoS attack

Attacks fall into three main groups, and each has its own defence.

Volumetric attacks

They fill the bandwidth to block the network path. The best known are UDP floods and DNS amplification. Defending against them needs a large network that can absorb the volume.

Protocol attacks

They use up the resources of network devices, such as firewalls and load balancers, by abusing protocol weaknesses. The SYN flood is the familiar example.

Application-layer attacks

They send requests that look like real users, for example an HTTP flood, to knock the application over. Because they are low in volume and look normal, they are harder to spot and need smart filtering.

How DDoS protection works

Protection at the network edge inspects traffic before it reaches your server. Suspicious traffic is spotted and dropped, and clean traffic goes on to its destination. Because filtering happens somewhere with very high capacity, even large attacks never reach your server and your server's link does not fill up.

The key is that filtering must always be on. Protection that starts after an attack begins is usually too late and the service is already down. Always-on protection means real users never notice an attack.

Detection

Traffic patterns are inspected: source, rate, packet type and behaviour. The further something is from the pattern of a real user, the more suspicious it is.

Filtering

Hostile traffic is dropped before it reaches the server. This happens at the network edge so your server's resources are never drawn in.

Clean traffic passes

The goal is not only to stop the attack; real users must carry on without slowdown or a pause.

Who needs DDoS protection?

If a service you run costs you when it goes out of reach, you need this protection.

Game servers

Unhappy players and rivals often target game servers. Protecting game UDP traffic is one of its main uses, and it is what we offer for game servers.

Websites and shops

Every minute of downtime is a lost sale and trust spent, especially on campaign days and special sales.

APIs and apps

Services that others depend on lose their customers along with their own uptime.

Busy bots and panels

Bots and panels with a big audience are easy targets for simple attacks and can run without worry when protected.

DDoS protection at CloudSnap

CloudSnap offers attack protection as a product, beside cloud servers, game servers and dedicated servers. The same wallet and Telegram bot; there is no separate service to buy and attach to your server. To hear when activation starts, tap Notify me in the bot.

Until then you can start on a cloud server and see plans on the pricing page. Every server you build will be ready to use protection when it launches.

Tips for staying safe

Network protection is one layer of security and works best beside other habits.

Keep the server's real IP private

If an attacker knows the server's direct IP they can bypass protection. Do not publish it.

Close unneeded ports

Every open port is more attack surface. Leave open only what you need.

Keep software updated

Many attacks exploit known weaknesses. Updating is the simplest defence.

Take backups

Even with the best defence, a backup gives peace of mind.

Before the first attack

If your service is under attack, the cost of downtime usually far exceeds the cost of protection. Have protection before the first attack, not after.

Signs of a DDoS attack

Telling an attack from an ordinary fault can be hard. A few signs help: a sudden, severe slowdown without any change to code or settings, bandwidth filling at hours when real traffic is low, an unusual rise in requests from a few sources or one region, and players or users dropping connection repeatedly.

If you see such signs, check server logs and network stats. An attack may last minutes or days and sometimes repeats in short waves to wear you down. Always-on protection means no manual diagnosis and no emergency response.

Cost of downtime vs cost of protection

When a service goes out of reach the cost is not only money. A player finds another game, a customer goes to a rival and trust, which takes long to build, is spent in hours. For services with hourly revenue, downtime comes straight out of your pocket.

See protection as insurance: you hope never to need it, but the day you do, it is the difference between a minor event and a crisis. Its cost is usually a fraction of the damage of one successful attack.

Build a cloud server today and switch protection on with one tap when it launches.

Network protection vs a firewall

A firewall runs on the server and inspects traffic that has reached it. That is excellent against intrusion but useless against a volumetric attack, because by the time traffic reaches the server the link is full. Network protection filters traffic before it reaches your link.

The best setup combines both: network protection for volume and a server firewall for access. Each covers its own layer, and missing one opens the gap the other leaves.