Players dropping all at once, the server unreachable but the panel fine? It might be a DDoS — or it might be ordinary lag. Here is how to tell the difference, confirm it with real tools, and what to do while it is happening and after.
Quick answer
Your game server is probably being DDoSed if every player drops or lags at the same moment while the server itself looks healthy — normal CPU and RAM — but cannot be reached, and inbound traffic shows a flood of packets from many different IPs. Ordinary lag has a visible cause, such as high CPU, a heavy plugin or one player's bad connection.
The tell-tale signs of a DDoS
- Everyone drops at once — not one laggy player, but the whole server timing out together.
- Sudden and total — it goes from fine to unreachable in seconds, with no gradual slowdown.
- The server process is healthy — CPU and RAM look normal, yet nobody can connect.
- Suspicious timing — it hits on a wipe, a match, an event, or right after a ban or argument.
- Inbound bandwidth spikes — your network graph shows a wall of incoming traffic.
DDoS or just lag?
Ordinary lag usually has a cause you can see: high CPU from too many entities, a heavy plugin, a bad mod, or one player on a poor connection. A DDoS is different — the machine is fine but the network is flooded. If the server itself looks healthy yet is unreachable, and inbound traffic is abnormally high, suspect an attack. (For genuine performance lag, see game server lag: CPU or network?)
How to confirm it
If you have console or network access, look at inbound traffic and packet rate: a flood of packets from many different IPs, often on odd ports, is the signature of a DDoS. On a managed host you usually will not need to — the provider's mitigation will already be reacting, and good panels show when filtering kicks in.
Tools that help you check
A simple traceroute or WinMTR from a player's machine to your server IP shows where packets are getting lost or delayed — helpful for telling a routing problem from an actual flood. On the server side, watching inbound bandwidth and connection counts usually makes an attack obvious: a sudden, sustained spike with no matching rise in legitimate player count. If packet loss rather than a hard outage is the symptom, see what causes packet loss and how to fix it.
False alarms: what looks like a DDoS but isn't
A patch-day download stampede, a popular streamer suddenly linking your server, or a misbehaving mod opening excessive connections can all mimic the "everyone drops at once" pattern of a real attack. The difference is usually duration and shape: organic spikes taper off, while a DDoS stays flat and heavy until it's filtered.
What to do in the moment
- Do not panic-rebuild — reinstalling the server does nothing to stop network traffic.
- Do not retaliate — fighting back with a booter is illegal and makes you the offender.
- Tell your host — if mitigation is not automatic, open a ticket so they can engage filtering.
- Protect your IP — never share the raw server IP; route players through the protected hostname.
After the attack: what to do next
Once things settle, don't just move on. Note the time, duration and any patterns — did it follow a ban, a wipe, a match? — in case it happens again, and check that your host's protection actually engaged as expected. If it's a repeated problem, it may be time for a broader security pass — see our game server security checklist.
How to stop it happening again
The only durable fix is to host behind always-on filtering, so attacks are absorbed upstream before they reach your machine. On a protected network, most attacks are mitigated automatically and your players never even notice. See how to protect your game server from DDoS.
If the server is healthy but nobody can connect, and traffic just spiked — that is not lag, that is an attack.