How to know if DDoS protection works?
I'm seeing a big unusual spike (not correlated with number of players in my game server) in my ipv4 traffic (the game I'm running is very notorious for having DDoS attacks). But, CPU and RAM usage shows normal numbers. Is that an indication of DDoS protection was doing its job?
Players in the server was complaining for a minute the server was laggy, so it might take a minute to kick the "machine learning" of the DDoS protection? Could it get better over time?
Or should I open a ticket to discuss it in details?
3 Replies
Update. The DDoS came in spikes. The second DDoS goes through my server way longer (running on 5 minutes now). The first DDoS was handled nicely. What I can do to log these DDoS attack for my support ticket?
mjones
Linode Staff
Generally speaking, if our DoS protections kick in you won't see any traffic from the DoS on your Linode. However, it may be that the DoS takes the form of legitimate traffic which our DoS protection wouldn't want to restrict. For example, if there's several bots all connecting to your game server normally and sending it data that appears normal, but has the goal of slowing down your game server, then the DoS protection may assume the traffic is legitimate event though it has the goal of degrading your game server's performance.
Since you mentioned that you're not seeing any additional CPU or RAM usage during the times of higher traffic, then it could be a DoS that is too small to have much of an impact or just an increase in normal traffic. If you open up a ticket, myself or another member of the Support team would be happy to take a look from our end and double check.
Thank you. I will open a support ticket.