Hi, I’m the author of the article and I’m horrified by how many spelling mistakes I made. I must have written this in a rage.
To answer your question, since we had control of the clients (since its a game) we used a proof of work challenge on TLS handshake which increased in complexity the more failed attempts you gave us.
Very cheap on the server, very expensive on the client, which effectively rate limited connection attempts.
Drop incoming SYNs when the CPU hits thresholds. More specifically, every second the cpu is at or above the 'bad times' threshold, increase the probability that you'll drop a SYN; every second the cpu is at or below the 'good times' threshold, decrease the probability that you'll drop a SYN.
I dont think its possible to do it without "any load" The hardware grabbing the packet, putting it into the socket buffers, analysing if its valid, requires some work.
Is it some sort of TCP window congestion control futzing? But even that wouldn't work since the client can do whatever the heck it wants.