DDoS is the threat every server owner hears about and few have explained simply. Here is what a DDoS attack actually is, how it differs from a plain DoS, how it works, and what really keeps you online — in plain English.
Quick answer
A DDoS (Distributed Denial of Service) attack floods a server, website or network with traffic or requests from many devices at once — usually a botnet of hijacked computers and IoT devices — until it runs out of bandwidth, CPU or memory and can no longer answer real users. Protection works by filtering the junk before it reaches the target.
What does DDoS mean?
DDoS stands for Distributed Denial of Service. "Denial of service" means making something — a game server, a website, a voice server — unavailable to the people who want to use it. "Distributed" means the attack comes from many machines at once instead of one, which makes it far harder to block.
The idea is simple: flood the target with so much traffic, or so many requests, that it runs out of bandwidth, CPU or memory and can no longer answer real players.
DDoS vs DoS: what's the difference?
A plain DoS (Denial of Service) attack comes from a single source — one machine, one connection — and is comparatively easy to block by filtering that one IP. A DDoS attack is distributed across thousands of sources at once, which is exactly what makes it so much harder to stop: there is no single address to ban. Nearly every attack seen against game servers today is a DDoS, not a DoS, because botnets made distributed attacks cheap and easy to launch.
How a DDoS attack actually works
Attackers control a botnet — thousands of infected devices (routers, cameras, IoT gadgets) scattered around the world. On command, every device fires traffic at your server's IP address at the same time. Your connection fills up, and legitimate players time out or get kicked.
Because the traffic comes from thousands of real IP addresses, you cannot simply "ban the attacker" — there is no single source to block.
The main types of DDoS attack
- Volumetric floods — raw traffic (UDP/ICMP) to saturate your bandwidth, measured in Gbps or Tbps.
- Protocol attacks — SYN floods and fragmentation that exhaust connection tables and firewalls.
- Amplification / reflection — small requests bounced off DNS or NTP servers that reply with huge responses.
- Layer-7 (application) attacks — floods of seemingly real requests aimed at panels, websites and login pages.
For a deeper split, see Layer 4 vs Layer 7 attacks.
Why game servers get hit so often
Game and voice servers are among the most-attacked targets online, because knocking one offline has an instant, visible payoff: a rival community steals your players, a banned user gets revenge, or someone demands payment to stop. Attacks often land at the worst moment — a wipe, a match or an event.
How long does a DDoS attack usually last?
It varies wildly — from a short burst of a few minutes meant to disrupt a specific match or wipe, to sustained campaigns lasting hours, or being repeated daily over weeks to wear a community down. Booter-rented attacks are often short and repeated, since the attacker is typically paying by the minute; grudge campaigns can be far more persistent.
Common DDoS myths
- "My firewall will block it" — a firewall can't stop volume that saturates the connection before it even reaches the firewall rule.
- "Changing my IP fixes it" — it buys minutes at best; a motivated attacker usually re-discovers a new IP quickly.
- "Only big targets get attacked" — small communities are hit constantly, because renting an attack costs almost nothing.
- "It's illegal so nobody actually does it" — it happens daily; enforcement is real, but attacks are still cheap and common.
Can you stop a DDoS yourself?
Not really, and that is the key thing to understand. You cannot out-bandwidth a terabit attack from a single server, and changing your IP only buys minutes. Real protection means the malicious traffic is absorbed and filtered upstream — on a large network in front of your machine — before it ever reaches you.
The honest answer: you do not "block" a modern DDoS on your own box. You host behind a network big enough to swallow it.
That is why every ESAGAMES service sits behind a multi-Tbps Frankfurt filtering network with in-house mitigation, on by default. For the practical defender's checklist, read how to protect your game server from DDoS.