Understanding Quake3 UDP Amplification DDoS Attack
DDoS (Distributed Denial of Service) attacks are formidable techniques that overwhelm online services and infrastructure by flooding them with too much traffic, making them unavailable to users. UDP Amplification is one of the common and, still most effective, techniques used by attackers.
This blog explains the UDP Amplification attacks exploiting Quake III Arena (Quake3) servers, including traffic patterns, and the PoC setup replication for research.
What is a UDP Amplification Attack
A UDP amplification DDoS attack is a type of Distributed Denial-of-Service (DDoS) attack where an attacker exploits the stateless nature of the User Datagram Protocol (UDP) to overwhelm a target system. In this attack, the attacker sends small requests with a spoofed source IP address (the victim's) to vulnerable UDP application servers. These servers then send larger UDP response packets to the victim in large volumes. The flood of UDP packets with amplified payload size drains the victim's network resources.
Why Quake III Arena is Vulnerable
Quake III Arena servers respond to unauthenticated getstatus queries with large packets containing detailed server status, player lists, and configuration data. These responses are significantly larger than the original requests, making them ideal for amplification attacks.
The absence of rate limiting or verification allows attackers to exploit these servers without needing to compromise them.
Reproducing the Vulnerable Setup
To study this vulnerability in a controlled environment, the ATI team deployed a local Quake III Arena server using the following steps:
Clone necessary repositories:
Clone the Game Engine Repository
git clone https://github.com/ioquake/ioq3.git
This clones the ioquake3 open-source game engine (a modernized version of the Quake III engine).
It creates a folder named ioq3 in your current directory. (You can rename this folder during or after cloning.)
Clone a Quake III Server Setup Repository
git clone https://github.com/nrempel/q3-server.git
This repository contains essential game data and configuration needed for setting up a basic Quake III server.
It creates a folder named q3-server.
Used only for its baseq3 directory, which contains .pk3 files (required game assets).
Compile the Quake engine:
Navigate to the folder you cloned and build the server:
This compiles the engine and generates server binaries under build/release-linux-*.
e.g. The output will be placed inside build/release-linux-x86_64 (for 64-bit Linux).
Set up the game server environment:
This copies the baseq3 folder (from the q3-server repo) into the hidden directory /root/.q3a.
The baseq3 folder contains files like pak0.pk3, which are mandatory for the game/server to run.
/root/.q3a is the default location where ioquake3 looks for game data. (Do not change this unless you want to modify engine configuration.)
Navigate to the Compiled Server Directory & Run the dedicated Quake III server
+set net_ip <ip>: Binds the server to your local IP address.
+map q3dm1: Loads map q3dm1, a default Quake III multiplayer map.
Once the server is active, it listens on UDP port 27960, which is the standard for Quake III Arena.
Observing the Traffic Pattern
Once the server is up and running, a simple getstatus query can be sent to observe the amplification:
This sends a getstatus request and prints the server's amplified response.
The server responds with a large statusResponse containing server configuration, map info, client slots, and version metadata — often hundreds of bytes.
Attack Traffic Analysis
For this type of attack, the UDP response sent by the Quake III Arena server appears as follows:
DDoS UDP Amplification: Quake3 Attack in Keysight ATI
At Keysight Technologies, our Application and Threat Intelligence (ATI) team, researchers have examined the traffic pattern of various UDP Amplification DDoS Attacks, and they have published the network traffic pattern of DDoS UDP Amplification: Quake3 as part of BreakingPoint System’s DDoS Lab in ATI-2025-04 Strike Pack.
Leverage Subscription Service to Stay Ahead of Attacks
Keysight's Application and Threat Intelligence subscription provides daily malware and bi-weekly updates of the latest application protocols and vulnerabilities for use with Keysight test platforms. The ATI Research Centre continuously monitors threats as they appear in the wild. Customers of BreakingPoint now have access to attack campaigns for different advanced persistent threats, allowing BreakingPoint Customers to test their currently deployed security control's ability to detect or block such attacks.