Not all DDoS attacks are the same. The biggest split is "Layer 4" vs "Layer 7" — and knowing the difference explains why some attacks flood your bandwidth while others quietly overwhelm your panel. Here is the breakdown, with real examples from gaming.
Quick answer
Layer 4 DDoS attacks flood the transport layer — UDP and TCP SYN floods that exhaust bandwidth and packet capacity. Layer 7 attacks target the application, sending requests that look like real visitors (HTTP floods) to exhaust a website, panel or API. Layer 4 is stopped by network filtering; Layer 7 needs application-aware checks such as browser challenges.
A quick note on "layers"
The names come from the OSI model, a way of describing networking in layers. For DDoS, two matter: Layer 4 (the transport layer — TCP/UDP) and Layer 7 (the application layer — HTTP, game protocols). Attacks at each layer look and feel very different.
Layer 4: network and transport floods
Layer 4 attacks are about raw volume. They throw enormous amounts of packets at your server to saturate its bandwidth or exhaust its connection tables. They do not care what your application does — they just want to fill the pipe.
- UDP floods — streams of UDP packets to swamp bandwidth.
- SYN floods — half-open TCP connections that exhaust the connection table.
- Amplification / reflection — DNS, NTP or Memcached responses multiplied back at you.
These are the headline-grabbing "terabit" attacks. The defence is capacity plus stateless filtering: a network big enough to absorb the volume, and filters (like XDP) that drop bad packets without tracking state.
Layer 7: application attacks
Layer 7 attacks are about cleverness, not volume. Instead of flooding bandwidth, they send requests that look legitimate but are expensive to answer — hammering a login page, a server-list query or a web panel until it falls over. They can take a site down with a fraction of the traffic a Layer 4 flood needs.
- HTTP floods — waves of GET/POST requests against a panel or website.
- Slow attacks — connections held open deliberately to tie up resources.
- Query floods — abusing a game's status/query port to exhaust the server.
Because the requests look real, Layer 7 needs smarter mitigation: rate-limiting, behavioural analysis and challenge checks that tell a real client from a bot.
Layer 4 vs Layer 7 at a glance
The two families differ in almost every way that matters — what they target, how big they are, and how you stop them:
| Layer 4 (network/transport) | Layer 7 (application) | |
|---|---|---|
| Goal | Saturate bandwidth / exhaust connection tables | Exhaust CPU, database or app logic |
| Traffic volume | Huge — up to terabits per second | Small — can down a site with little bandwidth |
| Looks like | A wall of raw packets (UDP/SYN) | Requests that look like real players/visitors |
| Typical targets | The game port, the raw connection | The web panel, login, server-list query |
| Defence | Network capacity + stateless filtering (XDP) | Rate-limiting, behavioural analysis, challenges |
| Give-away sign | Game port unreachable, inbound graph spikes | Game runs fine but panel/site is slow or times out |
Real examples of each layer in gaming
A Layer 4 attack on a game server usually looks like a wall of UDP packets aimed directly at the game port, trying to saturate the connection — the kind of volumetric flood botnets like AISURU specialise in. A Layer 7 attack instead targets the panel or website: a wave of login attempts, server-list queries or page loads designed to exhaust the web server or database behind the scenes, often at a fraction of the bandwidth.
How to tell which layer you're facing
You can usually tell them apart in under a minute by looking at where the pain is:
- Check your inbound traffic graph. A sudden wall of traffic that dwarfs your normal levels points to a volumetric Layer 4 flood.
- Try to reach the game port. If the game itself is unreachable while bandwidth is maxed, that's Layer 4.
- Check the panel and website. If the game is fine but the panel or site is slow, timing out or throwing errors, that points to Layer 7.
- Look for expensive endpoints being hammered — login, search, server-list query — a classic Layer 7 signature.
Our guide on is my game server being DDoSed covers the broader signs either way.
Which is worse?
Neither — they are different problems, and serious attacks now combine both (and rotate between vectors) to defeat one-trick filters. That is exactly why we mitigate at multiple layers: a multi-Tbps network for the volumetric Layer 4 floods, plus game-aware XDP and rate-limiting closer to the server for Layer 7.
Layer 4 tries to drown you; Layer 7 tries to outsmart you. Real protection has to answer both at once.
See how the layers fit together in how our Anti-DDoS works.