The A2S Challenge for Steam Game Servers

The A2S challenge makes anyone who queries your Steam game server prove they can receive a reply first, so spoofed queries cannot use your server as a reflector or flood it.

What A2S is

A2S is the query protocol behind the Steam server browser. When a player opens the server list, their game sends a small UDP packet to each server, and the server answers with its name, map and player count.

The reply is larger than the question, and UDP does not check where a packet came from. An attacker can send queries with a forged source address, so every reply goes to a victim instead. Sent fast enough, the same queries also keep your server busy answering instead of running the game.

What the challenge does

With the challenge on, a query from an address the network has not seen gets a short challenge instead of the full answer. A real game client sends the query again with the challenge in it and gets its answer, which takes a fraction of a second. A forged query never sees the challenge, so it never gets a full reply.

Only server-browser queries are challenged. Game traffic itself is not affected, and players already in the game do not notice anything.

Which games have it

The A2S challenge is available on the UDP profiles for Steam games that answer A2S queries, including Counter-Strike 2, Rust, ARK, Valheim, Garry's Mod, Team Fortress 2, Unturned, DayZ, Satisfactory, Arma 3, Squad and Project Zomboid, plus a generic Steam game profile for others. On these profiles it is on by default.

The Profiles page has an A2S column that shows whether it is on for each profile. A dash means the profile's protocol has no A2S to challenge.

Turn it on or off

The premade profiles keep it on. To run without it, create your own profile from Profiles with New profile, pick the same Protocol / Service, and turn A2S challenge off. Then apply that profile to your port, as described in How to Add a Service Rule for Your Game Server.

Leave it on unless something you rely on breaks. Current Steam clients handle the challenge. A very old server-list tool or monitoring script that does not may stop seeing your server; updating it is usually better than turning the challenge off.

Related guides

• Rate limits in a profile: how much each address may send, including queries.
• Game server DDoS protection: how Sterile protects game servers.

Questions about a specific game? Create a ticket or visit the support page.