Game and queries share one UDP port
There is no separate query port. Stats sites and browsers poll public servers constantly from many addresses, on the same port your players use.
SA-MP and open.mp DDoS protection
SA-MP and open.mp are covered by a port preset, not a protocol validator. The preset opens UDP 7777 with a packet ceiling, and every packet passes the address and transport checks and the behavioural engines. Prism does not read the SA-MP protocol, and this page is plain about what that leaves to you.
- Ports the preset opens
- UDP 7777
- Protocol validation
- No. Port preset only
- One-click preset
- SA-MP / open.mp
- Upstream capacity
- 17 Tbps, the same on every plan
- What it costs
- Included on every plan
The ports, and who should reach each one. The defaults; open whichever you actually configured.
| Port | What it carries | Exposure | In the preset |
|---|---|---|---|
| UDP 7777 | Game traffic and queries, on the same port. There is no second port. | Open to players | Yes |
A rule is TCP or UDP, never both.
What a SA-MP server exposes. Our SA-MP and open.mp guide does not document attack patterns specific to the game, so this page does not invent any.
These are the surfaces it does describe.
A tight ceiling costs your listing first
A packet-rate limit tuned only against your players counts all that query traffic too. Set too low, you lose your listing before you lose gameplay.
RCON rides the game channel
The RCON password travels over the same UDP port as the game, without encryption. The shipped value, changeme, is the first thing every scanner tries.
What Prism checks on a SA-MP rule. Layers 3 and 4, your ceilings and the engines that need no validator. There is no SA-MP protocol validator.
Every rule the SA-MP preset writes
The diagram stops where the checking stops.
- UDP 7777Layer 3 Address and packet sanityLayer 4 pps_limit 20000Layer 7 No validator
Layer 3, the address
Blocked sources and structurally malformed packets end here, at the lowest cost, exactly as on every other port.
Layer 4, the transport, and your ceilings
Spoofed and stateless floods are separated from traffic belonging to a real conversation, and the packet-rate ceilings on each rule apply. The preset ships UDP 7777 with a whole-port ceiling. Because queries share the port, fit it to your real traffic, listing polls included.
Signature (zero-day) engine on UDP rules
Learns the payload pattern of an in-progress attack and blocks it, without a rule being written first. It needs no validator.
Behavioural scoring
Timing regularity, reputation and tier demotion judge how a source behaves rather than what its payload says, which is why they work on a port with no validator.
Protocol validation for SA-MP
No validator ships for SA-MP. On a SA-MP rule the Protocol validation (L7) switch renders dim and reads "This service has no protocol validator. No effect on this one." A flood that uses the right port, stays under your ceilings and looks like nothing the behavioural engines recognise can reach your server.
Checked on every SA-MP ruleNot checked
The SA-MP / open.mp preset. One click writes the rules, added to yours exactly as if you had written them by hand.
What one click writes
One click writes the UDP 7777 rule with a packet ceiling. That one rule is everything: game traffic and queries share the socket, so there is no second port to find.
Applying a preset adds its rules, it never replaces yours, and applying it twice adds a second copy. A server holds 15 inbound rules, so check the table afterwards.
| Protocol | Port | Policy | Status |
|---|---|---|---|
| UDP | 7777 | 20K pps | Enabled |
Quick setup: apply a preset for a common workload
SA-MP / open.mp1 ruleApplied
Listed but showing offline?
A server that appears in the browser but shows offline or no player count is answering the master list but not queries: query is off in server.cfg, or something is dropping query packets while letting game packets through, such as a ceiling set below your real polling traffic.
Read the guideWhat no network filter can see
An RCON login with the right password is valid traffic on the game port. Change rcon_password before the first start, make it long and random, rotate it when someone leaves, or turn rcon off.
Read the guideWhich plan for a SA-MP server. Bigger plans add cores, memory and disk, not clock speed.
Our SA-MP and open.mp guide does not give a sizing figure, so this page does not invent one. What moves the load is in server.cfg: halving onfoot_rate roughly doubles the outbound traffic for player sync.
Deploy in
| VPS plan | vCPU | Memory | NVMe | Price | Order | |
|---|---|---|---|---|---|---|
| Nano | 1 | 2 GB | 20 GB | 1 vCPU, 2 GB memory, 20 GB NVMe | ₹890$9.49/mo | Deploy Nano |
| Mini | 2 | 4 GB | 40 GB | 2 vCPU, 4 GB memory, 40 GB NVMe | ₹1,780$18.99/mo | Deploy Mini |
| Starter | 3 | 6 GB | 60 GB | 3 vCPU, 6 GB memory, 60 GB NVMe | ₹2,670$27.99/mo | Deploy Starter |
| Growth | 4 | 8 GB | 80 GB | 4 vCPU, 8 GB memory, 80 GB NVMe | ₹3,560$37.49/mo | Deploy Growth |
| Pro | 6 | 12 GB | 120 GB | 6 vCPU, 12 GB memory, 120 GB NVMe | ₹5,340$56.49/mo | Deploy Pro |
| Elite | 8 | 16 GB | 180 GB | 8 vCPU, 16 GB memory, 180 GB NVMe | ₹7,120$74.99/mo | Deploy Elite |
| Max | 10 | 20 GB | 260 GB | 10 vCPU, 20 GB memory, 260 GB NVMe | ₹8,900$93.99/mo | Deploy Max |
| Titan | 12 | 24 GB | 400 GB | 12 vCPU, 24 GB memory, 400 GB NVMe | ₹10,680$112.49/mo | Deploy Titan |
How to size it
Start on a small VPS, change one sync or streaming value at a time, and watch bandwidth and CPU. CPU and traffic changes to a plan apply straight away; memory and disk at the next restart.
- Processor on every plan
- AMD EPYC 4584PX, up to 5.7 GHz
- Memory and disk
- DDR5 and NVMe
- Port
- 1 Gbit/s
- DDoS protection
- Included, always on
- Billing
- Monthly, prices exclude GST
Guides for running it. Step by step, in the help center, written against the same panel you will use.
What every SA-MP server on Clouduxe starts with.
- Boost clock, the same on every plan
- 5.7GHz
- Written by the SA-MP preset in one click
- 1rule
- Upstream mitigation, every plan
- 17Tbps
- Port on every plan
- 1Gbit/s
- Server uptime in the SLA, attacks excluded
- 99.99%
- Mumbai, Singapore and Limburg
- 3regions
SA-MP protection questions
Is the SA-MP protocol validated?
No. SA-MP and open.mp have a port preset, not a protocol validator. The rule gets the layer 3 and layer 4 checks, your packet-rate ceiling, the zero-day signature engine and the behavioural engines. The Protocol validation switch has no effect on it.
Does SA-MP DDoS protection cost extra?
No. The same filter and the same upstream capacity protect every plan in every region.
Which ports does a SA-MP or open.mp server need?
One: UDP 7777, or whatever you set port to. Game traffic and queries share it.
Should I run SA-MP or open.mp?
Start new servers on open.mp. SA-MP is no longer developed; open.mp accepts SA-MP clients and loads existing gamemodes, filterscripts and plugins.
Why did my server drop off the listings when I lowered the rate limit?
Queries from browsers and stats sites share UDP 7777 with your players, and they are the first thing a ceiling set too tight cuts off. Size the limit against your real traffic, polling included.
Which region should a SA-MP server use?
The one closest to your players: Mumbai for India, Singapore for Southeast Asia, Limburg for Europe. Protection is identical in all three.
Every SA-MP rule gets the full layer 3 and layer 4 filter.
The same 17 Tbps upstream and the same filter on every plan, in every region, enabled from the first boot.