Game Server DDoS Protection: How A2S Attacks Work

KarmaKrew runs its DayZ servers with VYKIX and VxShield. In early 2025, an attack campaign targeted its A2S query service: the part that answers the server browser when a player looks for somewhere to join. Flooding that service can hide a community from the browser while the game is still running.

We protect that query path separately from player connections. VxShield answers supported A2S_INFO requests from cached status at the Anycast edge, reducing repeated work on the DayZ host. Our incident write-up recorded KarmaKrew remaining available during the campaign.

What Is Game Server DDoS Protection?

We built VxShield to handle the network flood and check what the game is being asked to process. Upstream mitigation handles attack volume. Our DayZ protection checks the game protocol and sessions, while the query cache answers supported listing requests on the server’s behalf.

Ask which of those controls your hosting product includes. OVHcloud, for example, documents a Layer 7 game firewall for eligible Game servers. Check the profile enabled on your deployment as well as the provider’s advertised features.

How A2S Attacks Work

Steam’s A2S protocol lets a client request information about a server:

• “What is your server name?” (A2S_INFO)
• “Which players are listed?” (A2S_PLAYER)
• “What are your server rules and config?” (A2S_RULES)

These are UDP requests. Enough of them can consume bandwidth or processing time. Attackers can abuse replies for reflection too, depending on the server’s challenge handling and response behavior. Valve’s protocol-change announcement describes the A2S_INFO challenge exchange intended to resist reflection using forged source addresses.

During an incident, try both a browser query and a game join. A failed query tells you something about the listing service; you need the join test to check access to the game.

Use our VxShield DayZ protection guide to review those controls. If you run Rust too, its settings are in the Rust protection guide.

Why Query Protection Needs More Than a Bandwidth Figure

The server spends time processing each request it accepts. Spare bandwidth will not help if a stream of queries consumes the resources needed to answer them. The filter needs to recognize supported requests, handle challenges and apply rate controls where needed.

Closing the query port would block abuse and valid browser requests together. Test rule changes with a valid query and a direct game join so you can catch that kind of mistake.

Questions to Ask a Provider

Control	What to check
Volumetric filtering	Limits for bandwidth and packets per second
Query validation	Which requests pass and how challenges work
Query caching	Which fields are cached and when they refresh
Incident response	Which logs you can obtain and how engineers change filters
Availability	Records of browser replies, the game process and player sessions

How Protocol-Aware Filtering Works

Our configuration documentation describes VxShield’s DayZ game filter and its A2S query filter. They handle different exchanges: listing requests can use the cache, while game-session traffic goes through the game controls.

Always-On A2S Caching

At the Anycast edge, VxShield answers supported DayZ A2S_INFO requests with cached status. Repeated listing queries then require less work from the DayZ host.

The cache covers supported A2S_INFO requests; A2S_PLAYER and A2S_RULES are outside that scope. Check the game process as part of monitoring, since the cache can answer a status request without testing whether the game is healthy.

Smart Packet Inspection

The active profile checks requests for malformed content and uses rate controls to limit abusive patterns. A familiar sequence of bytes still has to meet the profile’s other requirements, such as challenge handling or session state.

Anycast + Edge Filtering

VxShield filters traffic at our global Anycast edge before it reaches the DayZ host. Routing determines the path through that network. Choose a hosting region that suits your players; the filtering locations and the location of the machine running DayZ serve different purposes.

Filter Changes During an Incident

Our engineers use traffic samples and VxShield’s drop counters to work out which checks need attention. A rule change needs to reject the abusive requests and still accept a valid browser query. We also check game joins, because restoring the listing does not test the player’s connection.

Case Study: KarmaKrew Stays Online During A2S Campaign

The KarmaKrew capture shows several traffic spikes between 13:50 and 14:20 during the 2025 campaign. The vertical scale and legend are missing, so we cannot read exact rates or identify which coloured series represent normal and attack traffic.

Repeated spikes in the KarmaKrew traffic capture between 13:50 and 14:20.

Our availability result comes from the incident report; we no longer have the player-session or uptime logs to check it. If you are documenting an attack on your server, save browser tests and game-session records alongside the traffic graph. They let you compare the flood with what players could access.

Case Study: StalkerZ Survives 643 Gbps

StalkerZ moved to VYKIX after attack-related problems, then faced a campaign in which the traffic patterns kept changing. We updated the filters as the campaign developed and reported a peak of 643 Gbps. The StalkerZ campaign case study walks through those rounds with the original traffic captures.

Common Questions

How do I protect my game server from DDoS attacks?

Ask your provider how it filters network floods, checks game traffic and handles server queries. Confirm the profile enabled on your server, then test both a browser reply and a game join.

What is an A2S DDoS attack?

An attacker floods the endpoints used by Steam’s A2S server-query protocol. A2S replies can be abused for reflection too; challenge handling and response behavior determine how the server resists that abuse.

Why do generic DDoS filters fail against game server attacks?

A rule based on traffic volume cannot check whether a packet belongs to a valid game exchange. Ask which game profile your product supports and which checks are enabled on your server.

Does VxShield protect against A2S DDoS attacks?

VxShield has DayZ filters and a cache for supported A2S_INFO requests. The cache answers listing requests at the edge, reducing query work on the DayZ host. Game sessions use their own filtering path.

Can DDoS attacks take a DayZ server offline for good?

Repeated outages can cost a community players and leave its owner with more recovery work. Filtering helps reduce the disruption. Restoring access and dealing with the effect on the community are both part of recovering from a campaign.

Stop A2S Attacks Before They Stop Your Server

If your DayZ listing disappears during an attack, bring us the query endpoint, timestamps and a failed join or browser test. That gives our team a place to start reviewing the traffic and VxShield rules with you.

VxShield comes with VYKIX plans, including managed DayZ and Rust hosting. Check the live portal for your selected recurring or upfront total, with VAT and unavoidable fees included.

Eligible switchers can receive best-effort migration and seven days added to the paid plan once we confirm the scope. Terms apply. See DayZ server hosting plans | Ask VYKIX on Discord

For help comparing costs and admin work, read the DayZ server cost guide. The Rearmed build story covers a historical hardware setup. Our 1.6 Tbps Rearmed retrospective follows the filter-development work, and the 2.56 Tbps Ground Zero report includes a detailed view of a later flood.