I dont think it would fully protect against connection floods either; inorder to determine the initiators IP the TCPClients RemoteEndPoint is used, which is possibly the only way to do it from .NET - but to get that information the socket must already be connected, atleast thats my understanding? Meaning you could in theory 'open' enough connections in a small amount of time and saturate the available listen sockets to prevent new connections establishing..
Its a step in the right direction though
Win and will probably provide a level of protection - its good to cover as many bases as possible however Firewalls and DDOS protection services are probably better equipt for handling these senarios where you can limit the number of new connections for X IP within a certain threshold.
A good DDOS provider is:
www.x4b.net - we used these guys when we banned a group of players from Artificial who then subsequently raised a very large DDOS on us for about two weeks - with enough traffic, it is extremely difficult to fully mitigate against these attacks through code alone.
Also using reverse proxys such as HAProxy with rate limiting abilities and also to 'hide' the real IP of the server can be another tactic, this allows you to have multiple endpoints for connections.
In terms of pack flooding, Heres a couple ideas - I'm not sure what is in place for Crystal, but on Artificial we limit the number of packets that can be processed within a loop cycle per player-
(this should be set high enough that normal operations should never cause it to hit the limit)
View attachment 29649
Also have a hard limit of how many queued packets a player can send before they are forcefully disconnected:
View attachment 29648
