ACTIVE DDoS ATTACK - Azure DDoS IP Protection is mitigating traffic but legitimate users cannot connect

@Alberto Cuello I hope you are doing well,Your telemetry shows that DDoS mitigation has engaged correctly (Under DDoS attack: 1), and the platform is filtering spoofed packets. However, legitimate players are being impacted because the unmitigated portion of the flood exceeds what a single standalone VM and game process can handle.

• Verify Accelerated Networking: Ensure Accelerated Networking (SR-IOV) is enabled on the VM's Network Interface (NIC). This bypasses the host virtualization switch, drastically increasing packet-handling capacity (PPS) and reducing CPU overhead from network processing.
• Scale Up the VM Size Temporarily: Move the VM to a compute-optimized or network-optimized series (e.g., Fsv2, Edsv5, or Dsv5 with at least 8–16 vCPUs). Larger VM SKUs provide substantially higher allocated network bandwidth and PPS limits.
• Strict NSG Filtering: In your Network Security Group (NSG), lock down all ports that are not strictly needed for gameplay (block management ports like SSH/RDP from 0.0.0.0/0, or restrict them to your specific admin IP).

References:

• Azure DDoS Protection telemetry and metrics overview
• Troubleshoot Azure Virtual Machine network throughput and PPS limits
• About Azure DDoS Protection tier comparison

If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.

Yes, the metrics indicate that Azure DDoS IP Protection is detecting and mitigating attack traffic, but that does not necessarily mean legitimate users will be unaffected.

Based on the values you've shared:

• 78.48K packets/sec identified as DDoS traffic confirms the public IP is under attack.
• 27.95K packets/sec dropped shows Azure is actively mitigating traffic.
• 39.07K packets/sec forwarded indicates a significant volume of traffic is still reaching the VM.
• The presence of both UDP and SYN mitigation thresholds being triggered suggests the attack may involve multiple vectors, potentially including UDP flood and TCP/SYN-based traffic.

However, DDoS metrics alone are not sufficient to conclusively determine the exact attack composition.

Azure DDoS Protection operates at the network edge and is designed to filter malicious traffic before it reaches your resources. However, traffic that is considered legitimate or cannot be confidently identified as malicious may still be forwarded.

As a result, legitimate users can still be affected if any of the following become constrained during the attack:

• VM CPU or memory resources
• VM network packet-processing capacity
• Guest OS TCP/UDP networking resources
• Application connection handling limits
• Game server thread pools, receive buffers, or connection backlogs

A packet-rate-driven attack can create pressure on the VM even when overall bandwidth consumption appears relatively modest.

Areas to investigate during the next attack wave:

Review the following metrics during the attack and compare them with normal operating conditions:

VM and network metrics

• CPU utilisation
• Memory utilisation
• Network In / Network Out
• Packet rates
• Connection counts

Guest OS and application metrics

• TCP connection backlog
• UDP receive errors or buffer exhaustion
• Socket utilisation
• Game-server process CPU and memory consumption
• Active player and connection statistics

Traffic analysis

• NSG Flow Logs
• Azure Network Watcher data
• Source IP distribution
• Destination ports and protocols
• Traffic patterns that differ from normal gameplay activity

I would recommend:

1. Verify that only required game ports are exposed.
2. Restrict administrative access (RDP/SSH) to trusted IPs, VPN, or Azure Bastion.
3. Remove any unnecessary Internet-facing endpoints.
4. Confirm the VM size provides sufficient packet-processing capability for the workload.
5. Review NSG rules to ensure only required protocols and ports are allowed.
6. Implement application-level rate limiting or connection throttling where supported by the game platform.

I would not conclude from the information provided that Azure DDoS Protection is malfunctioning. The more important question is whether the forwarded traffic is causing resource exhaustion at the VM, operating system, or game-server layer.

The most useful dataset to collect during the next attack wave is:

DDoS metrics + VM metrics + NSG Flow Logs + guest OS network counters + game-server connection statistics

Correlating these datasets should help identify whether the bottleneck is occurring at the Azure edge, VM networking layer, operating system, or within the game application itself.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.