What is Null Routing? Understanding DDoS Protection and Server Downtime

Learn how null routing protects servers during DDoS attacks, why it's necessary, and what it means for your VPS uptime.

Reading time: 6 min read

What is Null Routing? Understanding DDoS Protection and Server Downtime

If you're running a VPS or game server, you may have heard the term "null routing" mentioned in relation to DDoS attacks. Understanding what null routing is and why hosting providers use it is crucial for managing your expectations around uptime and security.

What is Null Routing?

Null routing (also called "blackholing") is a network security technique where all traffic to a specific IP address is dropped or sent to a "null" destination - essentially nowhere. It's like disconnecting a phone line when it's being flooded with spam calls.

How It Works

When a DDoS (Distributed Denial of Service) attack targets your server:

1. Attack Detection: The hosting provider's network monitoring detects abnormal traffic patterns
2. Automatic Response: The system automatically null routes your IP address
3. Traffic Dropped: All traffic to your IP (both attack traffic and legitimate users) is blocked at the network edge
4. Attack Mitigation: The attack traffic never reaches the server or affects other customers
5. Route Restoration: Once the attack subsides, the null route is removed and service resumes

Why Do Hosting Providers Use Null Routing?

1. Protects Network Infrastructure

A large DDoS attack can overwhelm network equipment, affecting not just your server but potentially hundreds of other customers on the same network. Null routing isolates the attack target.

2. Cost-Effective Protection

Advanced DDoS scrubbing (filtering attack traffic while allowing legitimate traffic) is expensive and requires specialized hardware. Null routing is a free, instant solution that works for most attacks.

3. Prevents Collateral Damage

Without null routing, a massive attack on your server could cause:

• Network congestion affecting other customers
• Router/switch overload
• Data center bandwidth saturation
• Service degradation across the entire network

4. Automatic and Fast

Null routing activates within seconds of attack detection, preventing prolonged network issues. Manual intervention would take much longer.

The Downside: Temporary Unavailability

When your IP is null routed:

• ❌ Your server becomes completely unreachable
• ❌ Legitimate users cannot connect
• ❌ Your services appear offline
• ❌ You cannot access your server remotely

However, this is temporary and typically lasts:

• Small attacks: 30 minutes to 2 hours
• Medium attacks: 2-6 hours
• Large/persistent attacks: 6-24 hours

Null Routing vs. Uptime SLA

Here's an important distinction:

Null Routing is NOT Counted as Downtime

Most hosting providers, including Bicore, do not count null routing periods as downtime for SLA (Service Level Agreement) purposes because:

1. Your server is still running - The VPS itself is operational
2. It's a security measure - Null routing protects your server and the network
3. It's attack-induced - The unavailability is caused by external attacks, not infrastructure failure
4. It's necessary protection - Without it, the attack could cause actual server crashes

What IS Counted as Downtime?

• Hardware failures
• Network equipment failures
• Power outages
• Software crashes on the host system
• Scheduled maintenance (if not announced)

When Attacks Affect Other Customers

In extreme cases, if your server is receiving persistent, massive attacks that:

• Overwhelm network capacity despite null routing
• Require constant manual intervention
• Affect other customers' services
• Consume excessive resources

Hosting providers reserve the right to suspend the VPS to protect the broader infrastructure. This is outlined in most Terms of Service agreements.

Bicore's Policy

At Bicore, if your VPS experiences:

• Large attacks: We will null route your IP (not counted as downtime)
• Persistent attacks affecting others: We may need to suspend your VPS with no refund to protect our network and other customers

This is a last resort, but necessary to maintain service quality for all customers.

How to Minimize Attack Impact

1. Use DDoS Protection Services

Consider additional protection layers:

• Cloudflare: Free tier offers basic protection
• TCPShield: Specialized Minecraft server protection
• OVH Game DDoS: Advanced gaming-specific protection

2. Hide Your Real IP

• Use proxy services to hide your actual server IP
• Never share your IP publicly
• Use domain names instead of direct IP connections

3. Implement Rate Limiting

• Configure firewall rules to limit connection rates
• Use fail2ban or similar tools
• Set up connection throttling

4. Monitor Your Server

• Watch for unusual traffic patterns
• Set up alerts for traffic spikes
• Keep logs for attack analysis

5. Have a Backup Plan

• Keep backups of your data
• Have a secondary IP ready if possible
• Document your recovery procedures

Understanding the Trade-offs

Null Routing (Standard Protection)

✅ Free and included with hosting
✅ Protects network infrastructure
✅ Automatic activation
❌ Server becomes unreachable during attacks
❌ No traffic filtering (all traffic blocked)

Advanced DDoS Scrubbing (Premium)

✅ Server stays online during attacks
✅ Filters malicious traffic
✅ Legitimate users can still connect
❌ Expensive (often Rs2000-Rs10000+ per month)
❌ May add slight latency
❌ Not 100% effective against all attacks

Frequently Asked Questions

Q: Will I be notified when my IP is null routed?

A: Most providers send automated notifications. Check your hosting panel and email for alerts.

Q: Can I prevent null routing?

A: Not if you're under attack. Null routing is automatic and necessary to protect the network.

Q: How long does null routing last?

A: Typically 30 minutes to 24 hours, depending on attack duration and severity.

Q: Will I get a refund for null routing downtime?

A: No. Null routing is not considered downtime and is not covered by SLA refunds.

Q: What if attacks keep happening?

A: Consider upgrading to advanced DDoS protection or using proxy services to hide your IP.

Q: Can I get a new IP address?

A: Yes, but attackers often find new IPs quickly. Address the root cause instead.

Conclusion

Null routing is a necessary evil in the hosting world. While it temporarily makes your server unreachable, it protects both your server and the broader network infrastructure from devastating attacks.

Understanding that null routing:

• Is a security feature, not a failure
• Is not counted as downtime for SLA purposes
• Is temporary and automatic
• Protects everyone on the network

...helps set realistic expectations for VPS hosting.

If you're frequently targeted by attacks, invest in additional DDoS protection layers or consider services that specialize in high-risk hosting environments.

Need Help with DDoS Protection?

Bicore provides null routing protection on all VPS plans. For questions about attacks, protection strategies, or upgrading your security:

Join our Discord | View VPS Plans

Related Topics:

• Server Security Best Practices
• Understanding VPS Uptime SLAs
• Choosing the Right DDoS Protection