The document discusses the growing issue of DDoS (Distributed Denial of Service) attacks affecting online esports. It notes that DDoS attacks aim to overload servers and make online services unavailable, which can disrupt important esports tournaments. While some basic prevention steps can help individual players, large esports events often require working with security specialists and dedicated anti-DDoS protection services to mitigate attacks. Proper anti-DDoS solutions need to filter malicious traffic while minimizing latency and reliably supporting the high-bandwidth and low-latency needs of competitive online gaming. Without adequate protection, DDoS attacks can negatively impact player experiences and hurt the esports industry.

1. What can possibly go wrong?
Why eSport needs an Anti-DDoS Protection
Justyna Czybier
Jakub Słociński

2. eSport? You are joking, right?
Short from electronic sport.
A multiplayer video game played competitively for spectators, typically by professional gamers
[en.oxforddictionaries.com] or the umbrella term for organised, competitive computer gaming,
usually between professionals [http://www.bbc.co.uk/guides/zygq2hv].
The majority of eSports titles are fighting games, first-person shooters (FPS), real-time strategy(RTS),
or multiplayer online battle arena games (MOBA), with the MOBA genre being the most popular in
terms of participation and viewership

3. FPS, MOBA, RTS? What does it even
mean?
Fighting games
FPS games
Source: [https://upload.wikimedia.org/wikipedia/en/e/e9/Street_Fighter_Logo.png];[https://graph.digiseller.ru/img.ashx?idc=277&w=200];[http://esportlivescore.com/img/games/-
10_65/overwatch.png];[http://i.imgur.com/7OPuh.png];[https://quake.bethesda.net/assets/images/quake-icon-4897721917.png];[https://eu.battle.net/forums/static/images/game-logos/game-logo-sc2.png];[https://bnetproduct-
a.akamaihd.net//dg/255/77B245C5E1B3F106F2A660108C8F9A607F06E5C0.png];[http://mmrdota.com/images/Dota2.png];[https://signup.eune.leagueoflegends.com/theme/signup_new_theme/dist/img/logo-lol-smaller.png];[https://web2.hirez.com/smite//wp-
content/uploads/2015/05/smite-logo.png];[https://cdn-tempostorm.netdna-ssl.com/img/hots/hots-logo.png?a67007a95c017d3d];[https://2welcome.staticwars.com/img/pff/splash-logo.ddb0a7dc.png];[http://www.bestcheats.pl/wp-content/uploads/2015/12/world-of-
tanks-logo.png];[http://www.strefammo.pl/wp-
content/uploads/2015/10/b8ba1cfcf1ef6147038e364d45a5c672e0e6f332.png];[http://mugenfreeforall.com/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fi.imgur.com%2FIu0Rg76.png&key=249413bc66e40581d4d623ae71720ca60b
7bdd0fa0d7117315cc5677ff82d3dd];[http://mugenfreeforall.com/applications/core/interface/imageproxy/imageproxy.php?img=https%3A%2F%2Fi.imgur.com%2FIu0Rg76.png&key=249413bc66e40581d4d623ae71720ca60b7bdd0fa0d7117315cc5677ff82d3dd];
RTS games
MOBA games
Other games

4. Let’s dig in history, shall we?
First tournaments was held in 1972 in the University of Stanford
(Intergalactic Spacewar Olympics) and in 1980 by Atari - Space Invaders Tournament
1990 - 2000: eSport focused on first person shooters, sports games, and arcade-style games till
the release of the real-time strategy (RTS) hit „StarCraft: Brood War”
2000 - now: exponential growth of eSport. Two major international tournaments were launched in
2000 (World Cyber Games and the Electronic Sports World Cup)
Source:
[https://www.reddit.com/r/gaming/comments/3aa15a/ataris_national_space_invaders_championship_held/];[http://adanai.com/esports/];[

5. Online gaming now
Top 3 most watched games on Twitch in march [https://newzoo.com/insights/rankings/top-games-twitch/]:
1. League of Legends
2. Counter Strike: Global Offensive
3. DOTA2
Top 3 most lucrative games [https://www.esportsearnings.com/games] :
1. DOTA 2
Number of recorded tournaments (since 2011): 735
Prize money awarded (since 2011): $99,291,136.92
2. League of Legends
Number of recorded tournaments (since 2010): 1861
Prize money awarded (since 2010): $39,522,139.21
3. Counter Strike: GO
Number of recorded tournaments (since 2000): 2290
Prize money awarded (since 2000): $32,294,249.23
http://knowyourmeme.com/memes/shut-up-and-take-my-money

6. „Według raportu sporządzonego pod koniec ubiegłego roku przez serwis XY Gain
łączna suma nagród we wszystkich turniejach pięciu największych gier
e-sportowych wyniosła ok. 193 miliony dolarów. Obok pieniędzy gwarantowanych
przez twórców gier oraz sponsorów zawodów i poszczególnych drużyn, branżę
zasilają również fundusze z reklam podczas transmisji na żywo. Rekordowy pod
tym względem zeszłoroczny wielki finał mistrzostw świata Leauge of Legends
przyciągnął 43 miliony unikalnych widzów. Tyle co ostatnie minuty finałowego
meczu NBA.” Michał „enki” Kuszewski, CD-Action
Celebrities Zone ;)

7. Source:
[newzoo 2017 GLOBAL ESPORTS MARKET REPORT (free), page 19]

8. People talk about it
According to SuperData raport „more people watch GVC (gaming video content)
than HBO, Netflix, ESPN and Hulu combined.”
Source:
[https://twitter.com/TwitterMktg/status/859182117611335685]; [https://www.superdataresearch.com/market-data/gaming-video-content/ ]

9. What doesn’t kill you is gonna give you lag
Biggest issues in online gaming? According to Jeff Kesselman answer is users :)
Source: [https://www.quora.com/What-are-the-biggest-problems-affecting-developers-of-online-games-e-g-MMOs]

10. Top 5 IT challenges to focus on
Speed-to-market
Availability
Latency
Scalability
Infrastructure costs
Source: [http://www.internap.com/2013/02/05/top-five-online-gaming-it-infrastructure-challenges/]

11. DDoS?
Distributed Denial of Service (DDoS) attacks overload a server with a huge volume of malformed
requests – to make an online service unavailable.
Basic types of attacks:
TCP Connection attacks
Volumetric attack
Protocol attack
Application attacks

12. Competitors
Hacker groups
Script Kiddie
If you can’t get online - you can't play

13. Source: [akamai’s [state of the internet] / security Q2 2016 report, page 18

14. Source: [https://www.akamai.com/us/en/multimedia/documents/brochure/eedar-akamai-gaming-infrastructure-and-consumer-sentiment-ebook.pdf, page 19]

15. Source: [https://www.akamai.com/us/en/multimedia/documents/brochure/eedar-akamai-gaming-infrastructure-and-consumer-sentiment-ebook.pdf, page 24]

16. Just buy it...
Source: [https://securelist.com/analysis/publications/77784/the-cost-of-launching-a-ddos-attack/]

17. Celebrities Zone ;) [part 2]
„Ataki typu DDoS są jednym z najbardziej szkodliwych zagrożeń dla całej branży
e-sportu. Obecnie w zasadzie nie organizuje się turniejów na wysokim szczeblu
bez współpracy ze specjalistami w dziedzinie ochrony sieci. W 2015 roku atak
przeprowadzony podczas mistrzostw świata Doty 2 o puli 18 milionów dolarów
zmusił organizatorów do dokonania kosztownych przerw i opóźnień w transmisji.
Na niższym szczeblu ataki wielokrotnie wpływały na wyniki meczów
kwalifikacyjnych rozgrywanych przez internet - wystarczy wyłączyć na kilkanaście
minut z rozgrywki pojedynczego zawodnika pięcioosobowej dużyny, by móc
zastosować regulaminowy przepis o poddaniu umówionego meczu z uwagi na
brak pełnego składu jednej z ekip” Michał „enki” Kuszewski, CD-Action

18. Ok, so what CAN I do?
Riot games created simple prevention sheet:
Make sure it’s DDoS
Protect your IP
Beware of Skype
Collect and analyse your NetLogs:
From file
Using Wireshark app
Incapsula.com advise more steps:
Use VPN
Keep your home network up to date
Source: [https://www.incapsula.com/blog/protecting-gamers-from-dos-ddos-attacks.html];[https://support.riotgames.com/hc/en-us/articles/201751764-DDoS-Prevention-Guide]

19. Some tips
Set UDP protocols limits (e.g. configure Iptables Firewall)
Change ports to other than defaults
Keep your kernel up-to date (you can also try to tune it’s settings e.g. sysctl.conf)
Think about using redundant services
Find trusted provider with Anti-DDoS service

20. What is killing online eSports
?
image: venturebeat.com / Riot Games

21. Network key values
• Low latency
„Online gaming customers are twice as likely to abandon a game when they experience a network
delay of 500 additional milliseconds.” [cedexis.com]
• Reliability
Almost every game needs online connection for distribution, multiplayer, transactions or authorization
• Bandwidth (yes, we also need it ☺)
• Security
Do not allow bad things on your infra

22. Networking protocols
• TCP provides reliable, ordered and error-checked delivery of a stream of bytes oriented in connections
Features like: buffering, retransmission (RTT), flow control (sliding window)
…but do we really care about data lost few seconds in the past??
• UDP is fast ☺
Features like: no ordering, no delivery checks, connectionless,
no flow control
• TCP + UDP?
check this out:
https://www.isoc.org/INET97/proceedings/F3/F3_1.HTM
• Modified TCP over UDP?
[UDP_HEADER, proto_id, seq, ack, …]

23. Tracking the infra
• Underestimated security (bro, it’s not banking, isn’t it?)
• Various custom protocols over TCP and UDP
• Attack the infrastructure vs. attack the application
• You don’t need to bring down the gaming infra
• 5min DDoS from 125Gbps capable botnet for $5 (incl. some bypassing options)
• DDoS offers to kill various AntiDDoS solutions
• Wait, you really said UDP? ☺
image: gta5-mods.com

24. UDP reflection + amplification
image: http://blogs.it.ox.ac.uk

25. Beeing the target or shooting?
• Quake 3 gaming protocol allows to get bandwidth amplification factor
of 63x to 82x (depends on connected clients) – server info messages (!)
• Steam protocol (e.g.: Half-Life, Counter-Strike or Team-Fortress)
allows to get amplification factor of 5,5x to almost 15x
Source: [„Amplification Hell: Revisiting Network Protocols for DDoS Abuse” Christian Rossow VU University Amsterdam, The
Netherlands Horst G¨ortz Institute for IT-Security, Ruhr University Bochum, Germany]

27. The shield
• First line of protection – TCP mitigation (used for webapps as well)
• Smart protection for UDP – custom engine protocols (reverse engineering?)
• Statefull inspection – protection is not about blackholing traffic per IP (really?)
• Always-ON – turning on and off while under attack may add latency jitter
• Minimal latency added – protection must be close to the infra
• Distributed

28. Example AntiDDoS protection

29. Summary
• DDoS will most likely disturb latency, bandwidth and reliability of your gaming
infra. All key factors at once.
• Then your players will get 404 or LAG => …and churn => you loose 
• Protection is a must have (or protection + secops team for bigger eSport
events)
• Allways-ON AntiDDoS systems that smartly filters the bad traffic out while
keeping the proper one
• Distributed protection system for Distributed Denial of Service attacks will do
the job even better

30. Q/A?
Thanks!
Justyna Czybier ( /id/PanZdzichu )
Jakub Słociński ( @KubaAtOvh )