Plenty of hosts say "DDoS protected". Here is what that actually means at ESAGAMES — the layers your traffic passes through step by step, and why protection is on by default for every service we host.
Quick answer
ESAGAMES Anti-DDoS filters traffic in layers before it reaches your server: everything first enters a multi-Tbps filtering network in Frankfurt that absorbs volumetric floods, then automatic scrubbing and protocol-aware filters drop attack traffic while real players pass. Protection is always on by default for every hosted service, because switching it on after an attack starts is already too late.
The problem we had to solve
Modern attacks reach terabits per second and ramp to full power in seconds. No single server can absorb that, and "turning on" protection after an attack starts is already too late. Protection has to live on a large network, in front of your machine, running all the time.
Layer 1 — a multi-Tbps network edge
All traffic to your server first enters our filtering network in Frankfurt, home to the world's largest internet exchange. This edge has the capacity to soak up large volumetric floods that would instantly saturate an ordinary connection.
Layer 2 — automatic scrubbing
Inside the network, traffic is continuously inspected. Known attack patterns — volumetric floods, protocol abuse, reflection and amplification — are dropped at the edge, while clean traffic for your players keeps flowing. There is no button to press; mitigation reacts in real time.
Layer 3 — in-house XDP filtering
On top of the upstream network we run our own mitigation built on XDP — packet filtering that runs in the Linux kernel at line rate, before traffic ever reaches the game process. This lets us write game-aware rules for the exact ports and protocols games use, instead of relying on generic filters.
- Game-aware — tuned for the real traffic of Minecraft, Rust, FiveM, CS2 and more.
- Line-rate — drops bad packets in the kernel without burning your server's CPU.
- Always on — no activation, no per-attack billing, no "protection add-on".
What happens to your traffic, step by step
When a player connects, their traffic first lands on our Frankfurt network edge, not directly on your server. It passes through the multi-Tbps scrubbing layer, then our in-house XDP filter, and only clean, legitimate traffic is forwarded on to your game process. The whole path adds negligible latency in normal conditions — the layers exist for the moments when traffic isn't normal.
How we monitor and tune filtering
Mitigation isn't "set and forget". We continuously watch traffic patterns across the network, and rules are tuned as new attack techniques and botnets — like AISURU — emerge. Because the XDP layer is ours, we can ship a new game-aware rule in hours rather than waiting on a third-party vendor's release cycle.
What a live attack actually looks like for you
In practice, most attacks are absorbed and filtered automatically with no action needed from you and no visible impact on your players. If you ever suspect something isn't behaving normally, our guide on is my game server being DDoSed covers how to confirm it and what to do while it's happening.
Why we built our own instead of reselling
Relying on a single upstream filter means you inherit its blind spots and its latency. By combining a multi-Tbps network with our own XDP layer, we control the rules, tune them for games, and keep mitigation close to the server — which means lower latency for players and fewer false positives.
Good protection should be invisible: your players never notice the attack, and you never get a bill for surviving one.
The result is simple for you: every game server, VPS and voice server we host is filtered by default. For the full technical write-up and a live mitigation view, see our Anti-DDoS page.