Most of what this does happens on ordinary days: SYN proxying, adaptive UDP and amplification filtering run inline on every packet whether anything is attacking you or not. On top of that sit 23 stateful layer 7 game filters, each validating traffic against what its protocol actually does.
There is no attack mode to enter and no threshold to cross. Filtering runs inline on every packet at the edge it arrives on, so the response to a flood is not a decision made after the fact — it is the same validation that was already happening. Nothing has to be recognised first, which is why a novel vector is not a free hit.
SYN cookies validate a connection before anything is forwarded, so a SYN flood never reaches the backend's connection table. This is ordinary running state on TCP services rather than something switched on during an incident.
Behavioural filtering for UDP services that have no protocol-specific filter yet. It adapts to the traffic the service actually sees, which is what keeps a long tail of small or proprietary titles defended without one filter each.
Each game filter holds connection state and checks packets for sequence and state consistency, not merely for shape. Forged connection floods are dropped at the edge without ever touching the session table on the server, and real players are never challenged or rerouted to prove they are real.
Allow and deny rules per address, and geo rules by source ASN or country code. The everyday control surface for traffic that is unwanted rather than hostile — a region you do not serve, or a network that only ever sends abuse.
Steam query traffic is answered from the edge cache rather than forwarded. A saturated backend keeps its listing, so a server stays findable while an attack drains instead of vanishing from the browser and taking hours to reappear.
Floods whose only ambition is to fill a pipe are absorbed across transit capacity before they reach the filtering tier. Nothing downstream sees them, and the answer to a saturating attack is never a null route.
Running something without a filter yet? Send a capture and the expected packet structure. Writing a filter per protocol is the product, not a favour — the list above is what that has produced so far.
Taken from the live mitigation engine rather than written by hand, so this page cannot advertise a filter that does not exist.
The everyday routines. These run inline on every packet, all the time, rather than switching on once something has been recognised as an attack — which is what makes the first novel flood as survivable as the hundredth familiar one.
One filter per protocol, each holding connection state and validating packets against what that protocol legitimately does. This is the part a generic scrubber cannot do: it has no way to tell a valid handshake from a well-formed forgery.
Infrastructure that sits beside the game fleet and gets attacked the same way — voice, remote access, resolvers and tunnels, each of which looks opaque to a filter that does not know the protocol.
Send a capture and the expected packet structure. Adaptive UDP covers the long tail in the meantime, and writing a filter per protocol is the product, not a favour.