On this page
Attacks against game servers are not one thing. They fail differently depending on what the attacker is trying to run out: your bandwidth, your connection table, your CPU, or your patience. Prism carries separate detection for each, and the reason a packet was dropped is recorded per event.
You will see these reasons on the Attacks tab when something is dropped, so this page is also the reference for reading that view.
Volumetric floods
The oldest shape: send more than the link or the server can absorb.
| Vector | What it is |
|---|---|
| Amplification | Small forged requests sent to third-party services that answer with much larger replies aimed at you. Common against exposed query and DNS ports |
| Aggregate flood | Raw packet volume at a port, from any number of sources, above what that port should ever receive |
| Per-source flood | A single address sending far more than any real client would |
| Out-of-band flood | Traffic aimed at a port using a framing the service never legitimately uses |
The very largest of these are absorbed upstream before they reach the machine. What arrives is handled at the port ceilings you set in Rate limits.
Spoofed and stateless traffic
Packets that claim to come from an address that did not send them. The attacker never sees a reply, which is exactly what makes it cheap for them.
| Vector | What it is |
|---|---|
| SYN flood | TCP connection openers that are never completed, filling the connection table |
| Spoofed UDP | UDP with forged source addresses, which has no handshake to fail |
| Fingerprint mismatch | A packet whose transport-level characteristics do not match any real client stack claiming to send it |
These are separated from real traffic by challenging the source. A genuine client answers a challenge as a side effect of connecting normally. A spoofed source cannot, because the answer goes to an address that never asked.
Connection exhaustion
Rather than volume, these attacks aim at the finite number of connections a server can track.
| Vector | What it is |
|---|---|
| Connection flood | Far more simultaneous connections from one source than a player needs |
| New connection rate | Connections opened faster than any human could, usually to force expensive setup work repeatedly |
| Distributed connection spread | Many sources in the same network range opening connections together, each one individually unremarkable |
| Half-open and idle abuse | Connections opened and then deliberately abandoned, or held open doing nothing, to occupy a slot |
This class is what usually takes a game server down while bandwidth graphs look completely normal, because the cost is in connection setup rather than in traffic.
Protocol abuse
Traffic that reaches the right port but is not the service speaking.
| Vector | What it is |
|---|---|
| Invalid protocol | The payload does not match how the service actually behaves, checked by the validator for that protocol |
| Failed handshake ratio | A source that keeps starting conversations it never correctly completes |
| Query flood | The public listing and status endpoints hit far harder than any listing service would |
| Malformed connect | Connection requests with fields that a real client never sends |
| Replayed connect | The same connection request sent repeatedly, captured from a genuine client |
| Command abuse | Valid protocol commands issued in a pattern designed to be expensive rather than to play |
This is the class a plain rate limit cannot see, because every packet is individually well formed and under any threshold. It is caught by Protocol validation.
Web and HTTP
For servers running an HTTP service alongside the game.
| Vector | What it is |
|---|---|
| Request flood | Requests per source, per connection, or in total, above what the service should serve |
| Missing client identity | Requests with no user agent at all, which no real browser or game client sends |
| Off-path requests | Requests hammering paths the service does not serve, usually scanning or probing |
Behavioural and unknown
The detections that do not depend on recognising a specific attack.
| Vector | What it is |
|---|---|
| Behavioural scoring | A source whose overall conduct does not resemble a client, judged across several signals rather than one |
| Timing regularity | Traffic arriving on a machine-perfect cadence, which humans and real clients do not produce |
| Reputation | A source that has already established a pattern of behaving badly against this server |
| Zero-day pattern | A shape the filter derived during this attack, with no signature written in advance |
| Tier demotion | A source that had earned trust and then stopped behaving like a client, losing it again |
These are why a novel attack does not have to be recognised before it can be stopped. See Inside the filter for how trust is accumulated and lost.
Policy
Not attacks, but the same drop path, so they appear in the same view.
| Reason | What it is |
|---|---|
| Blocked address | A source on your deny list. See Blocking and allowing IPs |
| Closed port | Traffic to a port with no rule permitting it |
| Honeypot | Traffic to a port that exists only to identify scanners, which no real client would ever contact |