What Happens When Your Minecraft Bedrock Server Is Attacked

Minecraft Bedrock clients connect over RakNet, and recent versions can also use the newer NetherNet transport. VibeSHIELD, the anycast DDoS protection network included with every VibeGAMES server, filters both. This article explains what happens when your Bedrock server is attacked, where you can see it and how to respond.

1What VibeSHIELD Does for Your Bedrock Server

• A RakNet filter protects the game port UDP 19132. Packets that do not follow the RakNet protocol that Bedrock uses are dropped.
• NetherNet filters for both UDP and TCP cover the newer NetherNet transport used by recent Bedrock clients.
• The filters run at the VibeSHIELD point of presence nearest to where the traffic comes from, across 46 locations worldwide. Only clean traffic continues to your server.
• No setup is required. The profile is applied to every Bedrock server automatically.

2What Players Notice

• In most attacks nothing. Players on phones, consoles and PCs stay connected.
• During very large attacks a few seconds of higher ping or packet loss can occur while filtering ramps up.
• If players cannot connect at all, start with the console in the game panel. A crash, running out of memory or a wrong port are far more likely causes than the attack.

3Where to See the Attack

• Log in to the website dashboard and open your Bedrock server.
• Click the DDoS protection tab. Note that this tab is in the website dashboard at vibegames.com, not in the game panel at game.vibegames.com.
• Status reads Active. Attack status reads Not under attack or Under attack.
• The Attack history table lists the attacks of the last 30 days: ID, peak size in Mbps or Gbps, start time and stop time.
• Expand a row to see a traffic chart over time, the source countries, source networks (ASN), source ports, destination ports, protocol, TTL and packet sizes.

4The Email You Receive

• Your account email receives a message with the subject DDoS attack detected on your server <ip> when an attack hits your server's port.
• It tells you that VibeSHIELD is filtering the traffic and that no action is needed.
• The IP is shared by several servers on the node. Each has its own port, and the attack is matched to your server by that port.

5What to Do

• Nothing is needed for the attack itself.
• Never share your server IP with someone who threatens you, and never pay anyone who claims they will stop an attack.
• Do not change the port. It does not help against attacks and is not needed.
• Do not ask for a move to another location. Every location is behind VibeSHIELD.
• If players report problems while the attack is listed, open a ticket and include the attack ID from the history table.

Good to Know

• Both transports are covered. Older clients on RakNet and newer clients on NetherNet are both filtered, so a mixed player base is protected in the same way.
• The protocol column tells you which one was hit. The breakdown of an attack shows the protocol and destination ports, so you can see whether UDP or TCP traffic was targeted.
• Read more. See how VibeSHIELD protects your game server for the network as a whole.