Null Routing and DDoS Attacks: Why Your Host Takes You Offline

Your game server drops mid-match, or your site stops answering, and support confirms what you feared: you were hit by a DDoS attack. Then comes the part that catches people off guard. Your host tells you the address was null-routed, and now nothing reaches your server at all, not even you. The attack may have already stopped, but you are still dark.

If that has happened to you, the flood was only half the story. The other half is a defensive move your provider made to protect everyone else on their network, and it is worth understanding, because it is often the difference between a short scare and an outage that drags on. This guide explains what null routing is in plain terms, why hosts do it, how to tell it happened to you, and what actually keeps your service reachable during an attack instead.

What null routing actually means

When traffic travels across the internet, routers act like signposts, each one passing your data toward the next step on its way to your server. Null routing changes one of those signposts. Instead of pointing traffic for your address toward your server, the provider points it at nothing. Every packet headed for that IP is quietly discarded.

The important word is every. A null route does not sort good traffic from bad. It drops the attack flood and your real visitors in the same motion, along with your own attempts to reach the box. Networking people call this blackholing, because traffic sent to the address disappears as if it fell into a black hole. You will also see the term null route, or, when it is triggered across networks using routing signals, remotely triggered blackhole filtering.

Picture a shop with one door. If a crowd blocks the entrance so no real customer can get in, one way to stop the chaos is to lock the door completely. The disturbance outside ends, but so does business. Null routing is the network version of locking the door.

Why your host reaches for it

Null routing can feel like your provider giving up on you. From their side it is closer to damage control, and the reason comes down to shared space.

Most servers do not sit on their own private connection. They share physical links and upstream capacity with many other customers. When a large flood aimed at one address fills that shared link, the congestion happens before anything separates traffic by who it was meant for. Neighbors who were never targeted start going down too. Our guide on DDoS protection for hosting providers covers this shared-fate problem in more depth.

Faced with one customer's attack threatening dozens of others, a provider that has no upstream filtering has few options. Dropping all traffic to the single targeted address is fast, it is cheap, and it instantly stops the flood from spilling onto everyone else. The carrier above them may even do it automatically the moment traffic to an address crosses a threshold. It is a blunt tool, but for a host without dedicated mitigation it is often the only one that works in seconds.

How long does a null route last?

A null route is usually temporary. Many providers lift it automatically after a set window, and some hold it until the attack traffic dies down and it looks safe to route the address again. That window varies by provider and can run from a few minutes to several hours. While it is in place, there is nothing you can do from inside the server, because the traffic never arrives. The policy your host follows ends up mattering as much as the attack itself.

How to tell you have been null-routed

A null route looks different from an ordinary crash, and telling them apart saves time.

• It is unreachable from everywhere, not just from you. A local network problem often clears up when you test from a phone on mobile data or ask someone in another location. A null-routed address stays unreachable from every location at once.
• Ping gets no reply at all. Instead of slow or partial responses, the address simply does not answer, because the packets are being dropped upstream before they reach it.
• The server itself looks healthy. If you have console or out-of-band access, the machine is usually running normally with an idle processor. It is not broken, it is cut off.
• Your host says so. The clearest confirmation is a support reply or status note mentioning a null route or blackhole on your IP. That is close to direct proof that an attack came in and the address was dropped in response.

Some of these overlap with the attack itself, which is why it helps to recognize the broader signs of a DDoS attack as well. The giveaway for a null route is that you stay offline even after the flood has stopped.

Why null routing still counts as losing

Null routing solves your provider's problem. It does not solve yours. The goal of a denial-of-service attack is to make your service unreachable, and a blackhole achieves exactly that, just from the inside rather than the outside. The attacker wanted you offline, and the null route delivers it, sometimes for longer than the flood itself would have lasted.

There is a knock-on cost too. If you react by moving your service to a fresh IP address to escape the blackhole, that new address can be discovered and targeted in turn. Chasing an attacker from address to address is a game you rarely win, and each move risks exposing the real location of your server.

The alternative: filter the traffic instead of dropping it

The reason null routing exists is that dropping everything is the only move left once a flood has already filled a shared link. Remove that constraint, and there is a better answer: separate the attack traffic from real visitors before it ever reaches that link, and pass only the clean traffic through.

This filtering step is usually called scrubbing. Traffic to your address is routed first through a network with far more capacity than the attack. The junk is discarded out there, where there is room to absorb it, and the legitimate visitors carry on to you. Your own connection sees a normal load even while an attack is underway, so there is no shared link to rescue and no reason to blackhole anything. A common way to hand that cleaned traffic back to you is a GRE tunnel, a private path that reaches your server without moving it anywhere.

Timing is the other half of the story. A flood can fill a connection in seconds, so protection that someone switches on after noticing an attack often arrives after the blackhole has already been triggered. Filtering that runs continuously closes that gap, a difference we cover in always-on filtering. Sterile Networks is built around this model, with always-on Layer 3 and 4 mitigation on every plan and clean traffic delivered over GRE or BGP. Layers 3 and 4 are the parts of network communication that handle addressing and connections, which is where these floods do their damage. You can see how whole address ranges are covered on the network and ASN protection page.

	Null routing	Upstream filtering
Attack traffic	Dropped	Dropped
Your real visitors	Dropped too	Passed through to you
Reachable during the event	No	Yes
Whose problem it solves	Your provider's shared network	Yours
Typical timing	After a link is already full	Continuously, before impact

What you can do about it

You cannot stop someone from pointing an attack at you, but you can decide in advance how that attack gets handled.

• Ask your host how they respond to floods. The question that matters is whether they filter attack traffic or simply null-route the target. A provider whose only answer is a blackhole is telling you that you will be taken offline to protect the rest of their network.
• Keep your real server address private. If your true IP is publicly known, an attacker can aim past any filtering and hit it directly, which forces the blackhole response all over again. Treat that address as something to guard.
• Put filtering capacity in front of what you run. Whether you protect a single server or a whole network, the aim is to have the flood absorbed somewhere with room for it, so your address never becomes the thing that has to be dropped.

If your service has already been null-routed once, that is usually a sign it will happen again. It is worth comparing the available protection plans or contacting the team to talk through your setup before the next attack rather than during it. A provider that never counts blocked attack traffic against you, and never has to drop your address to defend itself, changes what an attack costs you: a filtered nuisance instead of an outage.

Stay online. Stay Sterile.