Take a look at Netcode.io, all clients are auth'd with a token and any client that doesn't have the token gets ignored. The token also mandates what IP/hostname

Take a look at Netcode.io, all clients are auth'd with a token and any client that doesn't have the token gets ignored. The token also mandates what IP/hostnames are a valid destination. That way someone trying to DoS just gets their account blacklisted. Congestion control isn't going to help when a bad actor spoofs your protocol and dump GBs of data on you.