Distribution of IP source addresses experienced by Wolfenstein Enemy Territory game servers

Online multiplayer first person shooter (FPS) games typically limit themselves to between 4 and 30+ concurrent players, seemingly limiting the number of source IP addresses seen over time. However this report demonstrates how common FPS game servers usually ‘experience’ traffic from hundreds of unique IP source addresses every minute regardless of an individual game server’s popularity or local configuration. The cause is FPS server discovery - a two-step process where clients query a well-known master server for a list of registered game servers then probe each listed game server in turn. Thousands of clients every day create a continuous ‘background noise’ of probe traffic toward all registered game servers. Over 13 million probe packets were collected from two ‘Wolfenstein Enemy Territory’ servers in early 2006. This data was used to characterise the per-minute density of IP source addresses seen by network elements close to game servers. Probes from up to 100 to 550+ unique IP source addresses can be seen every 180 seconds. This report provides some initial insight into the potential memory requirements imposed by probe traffic on network devices that keep per-flow state.