Port 27015: Source Engine — Where the Internet Learned to Play

Port 27015 is the default port for Valve's Source Engine dedicated servers. If you have ever played Counter-Strike, Team Fortress 2, Left 4 Dead, Portal, Garry's Mod, or any of the hundreds of games built on Valve's engine, you have connected to port 27015. This is the port where gaming culture learned to organize itself, where esports began in earnest, and where the server browser became a window into a world of infinite possibility.

The Protocol

The Source Engine uses a proprietary UDP-based protocol for game traffic, with TCP used for administrative functions like RCON (Remote Console). When you launch Counter-Strike and click "Find a Game," your client sends an A2S_INFO query to port 27015 on potential servers. The server responds with its name, current map, player count, whether it requires a password, and whether Valve Anti-Cheat is enabled.¹

The protocol is elegantly simple. Queries begin with four 0xFF bytes followed by a single character indicating the query type. A2S_INFO uses 'T'. A2S_PLAYER uses 'U'. A2S_RULES uses 'V'. The server responds with the same header and the requested data.²

Client-server communication happens at high frequency, typically 20 to 30 packets per second. The client sends input samples (keyboard, mouse, microphone) to the server, which processes them authoritatively and sends back the game state. Clients only communicate with the server, never directly with each other.³

This architecture means the server on port 27015 is the single source of truth. It decides if your shot hit, if you captured the objective, if you survived the round. Every dispute is settled by the machine listening on that port.

The History

From Quake to GoldSrc (1996-1998)

The lineage of port 27015 begins with id Software's Quake engine. In 1996, Valve licensed the Quake engine and began heavily modifying it for their debut game, Half-Life. By the time Half-Life shipped in 1998, only about 25% of the original Quake code remained.⁴ Valve's engineers had rewritten the AI system, the skeletal animation system, and much more. They called their fork "GoldSrc" (Gold Source), though at the time it was simply "the Half-Life engine."⁵

Half-Life launched on November 19, 1998, and changed everything. Critics praised its storytelling, its AI, its immersion. It won over 50 Game of the Year awards. But the game's greatest gift to gaming culture was not the single-player campaign. It was the modding tools.

Counter-Strike Is Born (1999)

Minh Le, a Vietnamese-Canadian programmer who had fled Vietnam as a refugee when he was two years old, had been modding games since he discovered Quake in 1996.⁶ He created a mod called Navy SEALs for Quake, then moved to Action Quake 2, where he met Jess Cliffe, the mod's webmaster.

In January 1999, Le began working on a new Half-Life mod. He created weapon and player models while waiting for Valve to release the Half-Life SDK. On March 15, 1999, during an ICQ chat with Cliffe, Le suggested names for their project: "Counterrorism, Counter-Strike, Strike Force, Frag Heads, Counter-Terror, Terrorist Wars, Terror-Force, Counter Force." They settled on Counter-Strike.⁷

The first public beta released on July 15, 1999. It had one game mode (hostage rescue), nine weapons, four maps, and one player model per side. Players connected to servers on port 27015. The community responded with enthusiasm.

On April 12, 2000, Valve announced they had acquired Counter-Strike. Le and Cliffe became Valve employees. IGN would later rank them as number 14 on their "Top 100 Game Creators of All Time" list.⁸

Steam Changes Everything (2003)

Before Steam, finding a game server required third-party tools like GameSpy, The All-Seeing Eye, or HLSW. These server browsers would query port 27015 on thousands of servers and display the results in a list. It was cumbersome but magical: a window into every active game in the world.⁹

Valve launched Steam on September 12, 2003, initially as a way to automatically update their games. Counter-Strike 1.6 shipped with Steam, and all GoldSrc games were updated to require it.¹⁰ The transition was rocky. Only 20% of American households had broadband, and Steam's authentication servers struggled under the load.¹¹ Gamers complained. Valve persisted.

On November 16, 2004, Half-Life 2 became the first major game to require Steam for activation, even for retail copies. The Source Engine debuted alongside it, along with Counter-Strike: Source. The server on port 27015 had evolved, but its address remained the same.¹²

The Source Empire (2004-Present)

The Source Engine became the foundation of an empire:

• Counter-Strike: Source (2004): The controversial update that split the competitive community
• Day of Defeat: Source (2005): WWII combat reimagined
• Team Fortress 2 (2007): The hat economy begins
• Portal (2007): The cake is a lie
• Left 4 Dead (2008): Cooperative zombie survival
• Left 4 Dead 2 (2009): More zombies, more weapons
• Portal 2 (2011): Still alive
• Counter-Strike: Global Offensive (2012): The reunification
• Counter-Strike 2 (2023): The Source 2 era begins

Each game, by default, listens on port 27015. Each game can be queried with the A2S protocol. Each game can be administered remotely via RCON.

How It Works

The A2S Query Protocol

When a server browser needs information, it sends an A2S_INFO request to port 27015. The server responds with:¹³

• Protocol version
• Server name
• Current map
• Game directory (e.g., "cstrike", "tf", "l4d2")
• Current players and maximum players
• Number of bots
• Server type (dedicated or listen)
• Operating system (Linux/Windows)
• Password protection status
• VAC (Valve Anti-Cheat) status

In December 2020, Valve added a challenge-response mechanism to A2S_INFO. Previously, servers would respond immediately to any query, making them vulnerable to reflection amplification attacks. Now, servers may respond with a challenge number that the client must echo back.¹⁴

RCON: The Remote Console

RCON (Remote Console) is a TCP protocol that allows administrators to execute commands on a server without physical access to the machine. By default, RCON listens on the same port as the game server, TCP 27015.¹⁵

The protocol is simple: authenticate with a password, then send commands. But there are important security considerations:

• Passwords and commands are sent in plain text
• Multiple failed authentication attempts result in automatic IP bans
• If the RCON password is changed, all authenticated connections are immediately closed

Server administrators use RCON to change maps, kick players, adjust game settings, and monitor server health. It is the reason a server owner in Germany can manage a game server in Singapore from their phone.

The Master Server

When a Source server starts, it can register itself with Valve's master server. This makes it visible in the server browser for all players. The server sends periodic heartbeat messages to stay listed. If the heartbeats stop, the server disappears from the list.¹⁶

This system is how Counter-Strike can have over a million concurrent players and still let any player find any server in the world within seconds.

Security

Port 27015 has been a target for attackers since its inception.

Reflection Amplification

Because A2S_INFO responses are larger than requests, port 27015 is vulnerable to reflection amplification attacks. An attacker spoofs the source IP of their queries to match their victim's IP. Thousands of game servers respond, flooding the victim with traffic they never requested.¹⁷

The 2020 challenge-response update mitigates this, but older servers and games may still be vulnerable.

DDoS Attacks on Gaming Infrastructure

In early 2025, Cloudflare documented a massive DDoS campaign targeting a U.S. hosting provider that specialized in multiplayer gaming servers. The attack specifically targeted port 27015 and lasted 18 consecutive days, combining SYN floods, Mirai botnet traffic, and SSDP amplification.¹⁸

Gaming servers are attractive targets. They must keep port 27015 open. They often run on commodity hardware. Their operators may lack enterprise-grade DDoS protection. And taking down a popular server affects thousands of players, making it an effective form of harassment or extortion.

RCON Security

RCON's plain-text transmission is a known weakness. Administrators who connect over untrusted networks risk exposing their credentials. Tunneling RCON through SSH or a VPN is recommended for sensitive operations.¹⁹

The Culture

LAN Parties and Internet Cafes

In the late 1990s and early 2000s, port 27015 was the address of community. Before broadband was widespread, players would gather at LAN parties, connecting their computers directly to play Counter-Strike with minimal latency. Internet cafes (PC Bangs in South Korea) became social hubs where strangers became teammates.²⁰

The term "LAN party" is short for "Local Area Network party," but the spirit was always about presence: being in the same room as your opponents, hearing them curse when you landed the headshot, sharing pizza at 2 AM while the server hummed on port 27015.

The Birth of Esports

Counter-Strike tournaments began in 2000, but the watershed moment came at the 2001 Cyberathlete Professional League (CPL) Winter Championship in Dallas, Texas. The Swedish team Ninjas in Pyjamas won the $150,000 prize pool, and competitive gaming was never the same.²¹

The CPL, World Cyber Games (WCG), and Electronic Sports World Cup (ESWC) dominated the early 2000s. Players became celebrities. Sponsors invested millions. All of it happening on servers listening on port 27015.

In April 2025, Counter-Strike 2 reached an all-time peak of 1.86 million concurrent players, the highest in the franchise's 25-year history.²² The esports scene that began with a few hundred players in Dallas now fills stadiums worldwide.

Garry's Mod: The Sandbox

Garry Newman released his mod for Half-Life 2 on December 24, 2004. Garry's Mod was not a game with objectives. It was a physics sandbox where players could spawn objects, connect them with ropes and constraints, and build whatever they could imagine.²³

Valve noticed. They offered Newman a publishing deal. On November 29, 2006, Garry's Mod became a standalone $10 game on Steam. It sold 5,729 copies on day one. By November 2024, it had sold over 25 million copies.²⁴

Garry's Mod servers listen on port 27015. They host everything from role-playing communities to physics experiments to elaborate Rube Goldberg machines. The port that was designed for competitive shooters became the address of pure creativity.

Related Ports

The 27000 range is Valve's territory. Port 27015 sits at the center, the default address for game servers, the port that all other ports orbit.