Floods, Spoofing and Hijacking
The week Manja Arena tops the charts, its servers start receiving traffic that is not from players at all: bursts of connection requests that never finish, and floods of tiny datagrams from addresses that have never played. Each protocol has its own weak spots, and a game server needs to know which ones it exposes.
The rule
Never spend more on a stranger than the stranger spent on you.
SYN floods (TCP). Each SYN makes a server set aside state for a half-open connection while it waits for the final ACK. An attacker sends thousands of SYNs from forged addresses and never answers, the queue of half-open connections fills, and real players cannot get in. The defence, SYN cookies, stores nothing at all: the server encodes what it needs into its own starting sequence number, and rebuilds the connection only when a genuine ACK comes back carrying that number plus one.
Spoofing and amplification (UDP). UDP has no handshake, so a datagram's source address proves nothing; anyone can write any address there. Suppose an attacker sends a 50-byte "server info?" request with a victim's address as the source. If the server answers with 3,000 bytes, it has become a 60-times amplifier pointed at the victim. The defence: until an address has proved itself, never reply with more than you received.
Connection hijacking (TCP). Someone who knows a connection's four values and can guess its sequence numbers can inject segments into it: a forged RST that kills a player's lobby connection, or fake data. Modern systems choose unpredictable starting sequence numbers, and encrypting and authenticating the data with TLS makes injected bytes fail verification.
For truly huge floods, no single server can keep up. That traffic is absorbed upstream, by the hosting provider's DDoS protection, before it ever reaches the machine.
The shortcut
Before doing anything for a new sender, ask: "Has this address proved it can receive what I send it?" Until it has, send only small replies and store nothing.
Hello
The client sends a hello datagram padded to 1,200 bytes. The server stores nothing.
With every packet signed, a forged datagram claiming "I am player 7" fails the check and is dropped, whatever address it claims to come from.
Drills
Answer fast — trust the rule.
Why can a SYN flood exhaust a server with so little effort from the attacker?
How do SYN cookies defend against a SYN flood?
An attacker sends 50-byte requests forged with a victim's address, and the server answers each with 3,000 bytes. By what factor is the attack amplified?
Why can't the Manja Arena server trust a UDP datagram's source address on its own?
What makes injecting forged segments into a TCP connection hard?
Remember
- Never spend more on a stranger than the stranger spent on you.
- Ask "Has this address proved it can receive?" before replying big or storing state.
- Trap: trusting a UDP source address, or answering small requests with big replies.