Using Networking for Multiplayer Games in Java: TCP, UDP, WebSocket, and Server Design

Java has everything needed to build a multiplayer game: TCP sockets, UDP datagrams, selectable NIO channels, and a standard WebSocket client. The best starting point for most Java developers is an authoritative TCP server with explicit message framing, a fixed-step simulation loop, and clients that send input rather than declaring game outcomes. Move selected traffic to UDP only when measurement shows that TCP’s ordering and head-of-line blocking are limiting the game.

Opening a socket solves only transport. Multiplayer also requires a protocol, state synchronization, server authority, security, reconnection, testing, hosting, and operational limits.

#	Preview	Product	Price
1		TP-Link TL-SG105S-M2, 5 Port Multi-Gigabit 2.5G Unmanaged Ethernet Switch	$67.59	Buy on Amazon
2		TP-Link TL-SG108S-M2, 8-Port Multi-Gigabit 2.5G Unmanaged Ethernet Switch	$59.99	Buy on Amazon
3		TP-Link TL-SG105, 5 Port Gigabit Unmanaged Ethernet Switch, Network Hub, Ethernet Splitter, Plug &...	$14.99	Buy on Amazon
4		NETGEAR 5-Port Gigabit Ethernet Unmanaged Network Switch (GS305)	$15.99	Buy on Amazon

What multiplayer networking actually includes

“Networking” is several related systems:

• Transport: TCP, UDP, or WebSocket.
• Protocol: message types, framing, serialization, versions, and validation.
• Architecture: authoritative server, listen server, or peer-to-peer.
• Simulation: server ticks, commands, snapshots, prediction, and reconciliation.
• Session services: authentication, lobbies, matchmaking, relays, persistence, and reconnects.
• Operations: hosting, monitoring, logs, scaling, and abuse protection.

Java SE 21 provides Socket, ServerSocket, DatagramSocket, NIO socket channels, and the HTTP/WebSocket APIs. See the Java networking package, NIO channels, and WebSocket documentation. These examples target Java 21; check the APIs against the JDK selected by your project.

Choose the architecture before the API

Authoritative server

For competitive, persistent, or cheat-sensitive games, use a dedicated authoritative server. It owns canonical state, validates commands, applies movement and combat rules, broadcasts results, assigns identifiers, enforces rate limits, and removes disconnected players.

#1 Best Overall

TP-Link TL-SG105S-M2, 5 Port Multi-Gigabit 2.5G Unmanaged Ethernet Switch

• 𝗙𝗶𝘃𝗲 𝟮.𝟱 𝗚𝗯𝗽𝘀 𝗣𝗼𝗿𝘁𝘀 𝗳𝗼𝗿 𝗦𝘂𝗽𝗲𝗿-𝗙𝗮𝘀𝘁 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻𝘀: 5× 2.5-Gigabit ports unlock the highest performance of your Multi-Gig bandwidth and devices, and provide up to 25 Gbps of switching capacity.
• 𝗔𝘂𝘁𝗼-𝗡𝗲𝗴𝗼𝘁𝗶𝗮𝘁𝗶𝗼𝗻: Auto-negotiation intelligently senses the link speeds and adjusts between 3-speeds (100Mb/1G/2.5G) for compatibility and optimal performance for all your devices, including 2.5G WiFi 6 AP, 2.5G NAS, 2.5G PCIe Adapter, 2.5G Server, gaming computer, 4K video, and more.
• 𝗜𝗱𝗲𝗮𝗹 𝗳𝗼𝗿 𝗩𝗮𝗿𝗶𝗼𝘂𝘀 𝗦𝗰𝗲𝗻𝗮𝗿𝗶𝗼𝘀: Built for LAN parties, home entertainment, small and home offices, and instant transfer for workstations.
• 𝗛𝗮𝘀𝘀𝗹𝗲-𝗙𝗿𝗲𝗲 𝗖𝗮𝗯𝗹𝗶𝗻𝗴: Instantly upgrade to 2.5 Gbps without the need to upgrade to Cat6 wiring, reducing wiring costs and hassle. *
• 𝗦𝗶𝗹𝗲𝗻𝘁 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻: Industry-leading fanless design ensures silent operation, ideal for any home or business.

$67.59

Buy on Amazon

The client captures input, sends commands, renders known state, interpolates remote players, and may predict local movement. It must not decide its own damage, health, inventory, rewards, position, or match result.

MoveCommand {
    sequence: 1842
    directionX: 1.0
    directionY: 0.0
    buttons: 0
}

That is safer than accepting a client message such as PlayerState { x: 400, y: 220, health: 100 }.

Listen servers and peer-to-peer

A listen server lets one player host the match. It can be practical for small cooperative games, but host migration, host advantage, NAT traversal, disconnections, and privacy become your responsibility.

Peer-to-peer can suit small, trusted cooperative games. It is a poor default for competitive games because peers can be cheated, players may learn one another’s addresses, and synchronization, host migration, and persistent authority are difficult.

TCP, UDP, or WebSocket?

TCP is usually the correct first implementation. UDP is not automatically faster: routing, server location, tick rate, packet size, congestion, buffering, and protocol design affect end-to-end latency. Oracle documents UDP datagrams as connectionless, potentially reordered, and not guaranteed to arrive in DatagramPacket.

Use WebSocket when browser compatibility and HTTP infrastructure matter. Java’s standard API is a WebSocket client API, not a complete production WebSocket server framework. The Java HTTP module has been available since Java 11; asynchronous WebSocket creation uses HttpClient.newWebSocketBuilder().buildAsync(...).

A hybrid is common: use a reliable channel for login, inventory, match results, and important commands, then use selectively reliable or unreliable traffic for movement, aiming, snapshots, and transient effects.

Build a minimal TCP prototype

This learning scaffold demonstrates connection flow, not a production protocol.

Server

import java.io.*;
import java.net.*;
import java.nio.charset.StandardCharsets;
import java.util.concurrent.*;

public final class GameServer {
    private static final int PORT = 5000;
    private static final ExecutorService CLIENT_POOL =
            Executors.newVirtualThreadPerTaskExecutor();

    public static void main(String[] args) throws IOException {
        try (ServerSocket serverSocket = new ServerSocket(PORT)) {
            System.out.println("Listening on port " + PORT);
            while (true) {
                Socket client = serverSocket.accept();
                CLIENT_POOL.submit(() -> handleClient(client));
            }
        }
    }

    private static void handleClient(Socket socket) {
        String remote = socket.getRemoteSocketAddress().toString();
        System.out.println("Connected: " + remote);
        try (socket;
             BufferedReader in = new BufferedReader(new InputStreamReader(
                     socket.getInputStream(), StandardCharsets.UTF_8));
             BufferedWriter out = new BufferedWriter(new OutputStreamWriter(
                     socket.getOutputStream(), StandardCharsets.UTF_8))) {
            out.write("WELCOMEn");
            out.flush();
            String line;
            while ((line = in.readLine()) != null) {
                System.out.println(remote + " -> " + line);
                out.write("ACK " + line + "n");
                out.flush();
            }
        } catch (IOException e) {
            System.out.println("Disconnected: " + remote);
        }
    }
}

Client

import java.io.*;
import java.net.*;
import java.nio.charset.StandardCharsets;

public final class GameClient {
    public static void main(String[] args) throws IOException {
        try (Socket socket = new Socket("127.0.0.1", 5000);
             BufferedReader in = new BufferedReader(new InputStreamReader(
                     socket.getInputStream(), StandardCharsets.UTF_8));
             BufferedWriter out = new BufferedWriter(new OutputStreamWriter(
                     socket.getOutputStream(), StandardCharsets.UTF_8))) {
            System.out.println(in.readLine());
            out.write("HELLO player1n");
            out.flush();
            System.out.println(in.readLine());
        }
    }
}

Compile and run the server first, then the client. The example has no authentication, TLS, heartbeat, timeout, game loop, backpressure, frame limit, or reconnect handling. Newline framing also cannot safely represent arbitrary binary payloads.

Rank #2

Sale

TP-Link TL-SG108S-M2, 8-Port Multi-Gigabit 2.5G Unmanaged Ethernet Switch

• 𝗘𝗶𝗴𝗵𝘁 𝟮.𝟱 𝗚𝗯𝗽𝘀 𝗣𝗼𝗿𝘁𝘀 𝗳𝗼𝗿 𝗦𝘂𝗽𝗲𝗿-𝗙𝗮𝘀𝘁 𝗖𝗼𝗻𝗻𝗲𝗰𝘁𝗶𝗼𝗻𝘀: 8× 2.5-Gigabit ports unlock the highest performance of your Multi-Gig bandwidth and devices, and provide up to 40 Gbps of switching capacity.
• 𝗔𝘂𝘁𝗼-𝗡𝗲𝗴𝗼𝘁𝗶𝗮𝘁𝗶𝗼𝗻: Auto-negotiation intelligently senses the link speeds and adjusts between 3-speeds (100Mb/1G/2.5G) for compatibility and optimal performance for all your devices, including 2.5G WiFi 6 AP, 2.5G NAS, 2.5G PCIe Adapter, 2.5G Server, gaming computer, 4K video, and more.
• 𝗜𝗱𝗲𝗮𝗹 𝗳𝗼𝗿 𝗩𝗮𝗿𝗶𝗼𝘂𝘀 𝗦𝗰𝗲𝗻𝗮𝗿𝗶𝗼𝘀: Built for LAN parties, home entertainment, small and home offices, and instant transfer for workstations.
• 𝗛𝗮𝘀𝘀𝗹𝗲-𝗙𝗿𝗲𝗲 𝗖𝗮𝗯𝗹𝗶𝗻𝗴: Instantly upgrade to 2.5 Gbps without the need to upgrade to Cat6 wiring, reducing wiring costs and hassle. *
• 𝗦𝗶𝗹𝗲𝗻𝘁 𝗢𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻: Industry-leading fanless design ensures silent operation, ideal for any home or business.

$59.99

Buy on Amazon

Frame TCP messages explicitly

TCP is a byte stream. A read may return half a message, several messages, or exactly one message. Never assume one write corresponds to one read.

+------------+------------+-------------------+
| Length 4 B | Type 2 B   | Payload           |
+------------+------------+-------------------+

Use a fixed byte order, normally network byte order, and validate lengths before allocating memory.

import java.io.*;

record Frame(int type, byte[] payload) {}

final class Protocol {
    static final int MAX_FRAME_SIZE = 64 * 1024;

    static Frame readFrame(DataInputStream in) throws IOException {
        int length = in.readInt();
        if (length < 2 || length > MAX_FRAME_SIZE)
            throw new IOException("Invalid frame length: " + length);

        int type = in.readUnsignedShort();
        byte[] payload = in.readNBytes(length - 2);
        if (payload.length != length - 2)
            throw new EOFException("Unexpected end of frame");
        return new Frame(type, payload);
    }

    static void writeFrame(DataOutputStream out, int type, byte[] payload)
            throws IOException {
        if (payload.length > MAX_FRAME_SIZE - 2)
            throw new IOException("Payload too large");
        out.writeInt(payload.length + 2);
        out.writeShort(type);
        out.write(payload);
        out.flush();
    }
}

A real protocol should also define a protocol version or capability negotiation, message semantics, authentication state, unknown-message behavior, and limits for nested counts and collections. Decide whether unknown types are ignored for forward compatibility or rejected as protocol errors.

Choose a serialization format

Protocol Buffers, FlatBuffers, MessagePack, and similar formats can all be reasonable. Choose based on browser and language support, schema evolution, payload frequency, and debugging needs. Never use Java native object serialization with untrusted multiplayer clients; explicit formats avoid unnecessary deserialization and compatibility risks.

Separate networking from the game loop

Do not let arbitrary socket-reader threads mutate world state. A robust arrangement is:

Network reader  -> validate and queue commands
Game loop       -> consume commands, simulate, create snapshots
Network writer  -> send bounded outbound data

final long tickNanos = 50_000_000L; // 20 ticks per second
long nextTick = System.nanoTime();

while (!Thread.currentThread().isInterrupted()) {
    long now = System.nanoTime();
    if (now >= nextTick) {
        drainAndValidateCommands();
        updateSimulation(0.05f);
        broadcastSnapshots();
        nextTick += tickNanos;
        if (now - nextTick > 1_000_000_000L)
            nextTick = now;
    } else {
        Thread.onSpinWait();
    }
}

Twenty ticks per second means a 50-millisecond simulation step. Tick rate is not render frame rate. A turn-based game may update only when commands arrive; an action game may need more frequent simulation. Higher rates consume more CPU and bandwidth. The important properties are controlled state ownership, fixed-step behavior, and protection against an unbounded catch-up spiral.

Virtual threads can simplify blocking I/O in modern Java, but they do not solve simulation contention, memory limits, bandwidth, or backpressure. Bound command and outbound queues. A client that cannot consume snapshots must be disconnected or given a policy that drops superseded state.

Commands, events, and snapshots

• Inputs: intent such as movement, aim, firing, or ability activation.
• Events: facts such as a player joining, a door opening, an item being collected, or a match ending.
• Snapshots: current state such as positions, velocities, health, and animation state.

Inputs are applied by the server. Events are generally processed once and in order. Snapshots supersede older snapshots, so stale ones can often be discarded.

Snapshot {
    serverTick: 7821
    acknowledgedInput: 1842
    entities: [...]
}

Acknowledging input lets a client remove confirmed commands from its prediction queue. Depending on bandwidth and game rules, send full snapshots, deltas, or a combination of snapshots and events.

Rank #3

Sale

TP-Link TL-SG105, 5 Port Gigabit Unmanaged Ethernet Switch, Network Hub, Ethernet Splitter, Plug & Play, Fanless Metal Design, Shielded Ports, Traffic Optimization

• 𝗢𝗻𝗲 𝗦𝘄𝗶𝘁𝗰𝗵 𝗠𝗮𝗱𝗲 𝘁𝗼 𝗘𝘅𝗽𝗮𝗻𝗱 𝗡𝗲𝘁𝘄𝗼𝗿𝗸: 5× 10/100/1000Mbps RJ45 Ports supporting Auto Negotiation and Auto MDI/MDIX.
• 𝗚𝗶𝗴𝗮𝗯𝗶𝘁 𝘁𝗵𝗮𝘁 𝗦𝗮𝘃𝗲𝘀 𝗘𝗻𝗲𝗿𝗴𝘆: Latest innovative energy-efficient technology greatly expands your network capacity with much less power consumption and helps save money.
• 𝗥𝗲𝗹𝗶𝗮𝗯𝗹𝗲 𝗮𝗻𝗱 𝗤𝘂𝗶𝗲𝘁: IEEE 802.3X flow control provides reliable data transfer and Fanless design ensures quiet operation.
• 𝗣𝗹𝘂𝗴 𝗮𝗻𝗱 𝗣𝗹𝗮𝘆: Easy setup with no software installation or configuration needed.
• 𝗔𝗱𝘃𝗮𝗻𝗰𝗲𝗱 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗙𝗲𝗮𝘁𝘂𝗿𝗲𝘀: Prioritize your traffic and guarantee high quality of video or voice data transmission with Port-based 802.1p/DSCP QoS and IGMP Snooping.

$14.99

Buy on Amazon

Interpolation, prediction, and reconciliation

Interpolation renders remote entities between known snapshots, avoiding visibly abrupt movement. Client-side prediction applies the local player’s input immediately instead of waiting for a round trip. Reconciliation corrects prediction when authoritative state arrives:

1. Replace predicted state with the server state.
2. Discard acknowledged inputs.
3. Reapply unacknowledged local inputs.
4. Continue rendering from the corrected result.

Prediction is a presentation technique, not permission for the client to define outcomes. Server corrections should be handled deliberately: snap when the error is dangerous, or blend small corrections when visual smoothness matters.

When UDP is justified

UDP can be useful when old movement data becomes worthless and waiting for retransmission is worse than dropping it. It does not guarantee delivery, ordering, or uniqueness, and it does not automatically bypass NATs, firewalls, or operating-system constraints.

A serious UDP protocol must define:

• Sequence numbers and stale-packet rejection.
• Acknowledgements, duplicate suppression, and selective retransmission.
• Reliable versus unreliable message classes.
• Packet-size and fragmentation rules.
• Heartbeats, timeouts, rate limits, authentication, and replay protection.

+---------+---------+----------+----------+----------------+
| Version | Type    | Sequence | Ack      | Ack bitfield  |
+---------+---------+----------+----------+----------------+

For example, movement snapshots might be unreliable and sequenced, while match results and critical inventory events use reliable delivery. Test UDP on real networks; localhost success proves very little.

WebSocket in Java

WebSocket is a practical option for browser clients, turn-based games, dashboards, lobbies, and low-frequency game communication. The JDK API supports text and binary messages, ping/pong, close operations, listeners, and asynchronous sends that return CompletableFuture.

It is not a universal UDP replacement. WebSocket generally uses a reliable stream transport, so ordering and head-of-line behavior remain below the game layer. A useful division is HTTPS or REST for accounts and matchmaking, WebSocket for lobby communication, and a specialized or UDP-based transport for latency-sensitive gameplay.

Security and abuse resistance

Authenticate before a player enters a match and use TLS when credentials or sensitive data cross the network. Validate every message’s type, length, range, identity, and frequency.

if (command.speed() < 0 || command.speed() > MAX_ALLOWED_SPEED) {
    throw new ProtocolException("Invalid speed");
}
if (!world.containsPlayer(command.playerId())) {
    throw new ProtocolException("Unknown player");
}

Also reject oversized frames, cap collection counts, rate-limit clients and global traffic, avoid logging secrets, prevent replay of important commands, use server-generated identifiers, and avoid exposing internal exceptions.

Common attacks include forged movement, cooldown bypass, rapid-fire commands, oversized allocations, connection exhaustion, replayed rewards, deliberate slow reads, invalid entity identifiers, and integer overflow in coordinates or counts.

Rank #4

NETGEAR 5-Port Gigabit Ethernet Unmanaged Network Switch (GS305)

• GIGABIT ETHERNET PORTS: Features 5 x 1.0Gbps Ethernet ports for high-speed connectivity. Auto-negotiating ports detect the optimal speed for connected devices and work with existing Cat5e or Cat6 Ethernet cables.
• PLUG-AND-PLAY UNMANAGED NETWORK SWITCH: Simple plug-and-play setup with no software to install or configuration required.
• FLEXIBLE MOUNTING OPTIONS: Compact metal design supports desktop or wall-mount placement for versatile installation.
• SILENT & ENERGY-EFFICIENT OPERATION: Fanless design ensures silent performance, while IEEE 802.3az Energy Efficient Ethernet reduces power consumption without compromising high-speed network performance.
• REGIONAL COMPATIBILITY: Made for use in U.S. & CA only

$15.99

Buy on Amazon

Heartbeats, timeouts, and reconnects

An open TCP connection does not necessarily prove that a player is reachable. Define authentication and idle timeouts, heartbeat intervals, missed-heartbeat limits, reconnect grace periods, session expiration, and shutdown behavior.

Example policy:
- Heartbeat every 5 seconds
- Disconnect after 3 missed heartbeats
- Reconnect token valid for 30 seconds

These are configurable examples, not universal defaults. A reconnect design must decide whether the player resumes the old session, receives a fresh identity, or is removed immediately. Never replay old commands blindly after reconnect.

Testing beyond localhost

1. Start the server and connect one client.
2. Connect several clients and send valid commands.
3. Verify that the server, not the client, changes authoritative state.
4. Close clients abruptly and confirm cleanup.
5. Reconnect and check that stale sessions do not remain active.

Then test half-written frames, multiple frames in one TCP read, invalid lengths, unknown message types, slow readers, flooded clients, delayed and duplicated packets, reordered and lost UDP packets, high latency, conflicting commands, clock changes, and a server that falls behind.

Test on localhost, a LAN, a different ISP, and a cloud or hosted environment. Simulated latency and packet loss are essential for finding prediction, timeout, and queue bugs.

Standard library, NIO, or a library?

Use standard-library sockets when the player count is modest, TCP is sufficient, and minimal dependencies and debuggability matter. Use SocketChannel, DatagramChannel, and selectors when many connections are mostly idle or the team needs multiplexed non-blocking I/O. An event-loop networking library can reduce boilerplate, but it adds a dependency and requires comfort with event-driven design.

Choose based on actual connection counts, message rates, payload sizes, and team expertise—not on the assumption that a particular API is inherently faster.

Hosting and managed services

A self-hosted VM or container is often the simplest commercial route for an all-Java prototype: package the server as a JAR or container, expose the required TCP or UDP port through a firewall, and add monitoring, backups, logs, and deployment automation.

Managed services become useful when you need matchmaking, scaling, server allocation, QoS, telemetry, or operational security. Amazon GameLift Servers documents managed hosting and matchmaking, but its current onboarding material lists custom server integration environments including C++, C#, and Go. Do not assume that its Java AWS SDK is a Java-native game-server SDK; verify the integration path for your project. GameLift compute pricing varies by region and instance type, and AWS describes usage-based billing; FlexMatch standalone pricing is listed by AWS as $20 per million player packages plus $1 per matchmaking hour. Check current pricing before budgeting.

Amazon GameLift documentation and GameLift getting started are the relevant references. Microsoft PlayFab’s multiplayer documentation covers servers, matchmaking, lobbies, Party, QoS, and billing; verify the supported client and server languages for the specific service you plan to use.

Quick Recap

Bestseller No. 1

TP-Link TL-SG105S-M2, 5 Port Multi-Gigabit 2.5G Unmanaged Ethernet Switch

$67.59

SaleBestseller No. 2

TP-Link TL-SG108S-M2, 8-Port Multi-Gigabit 2.5G Unmanaged Ethernet Switch

$59.99

SaleBestseller No. 3

TP-Link TL-SG105, 5 Port Gigabit Unmanaged Ethernet Switch, Network Hub, Ethernet Splitter, Plug & Play, Fanless Metal Design, Shielded Ports, Traffic Optimization

$14.99

Bestseller No. 4

NETGEAR 5-Port Gigabit Ethernet Unmanaged Network Switch (GS305)

REGIONAL COMPATIBILITY: Made for use in U.S. & CA only

$15.99

A practical build order

1. Implement an authoritative server on TCP.
2. Define versioned, length-prefixed messages.
3. Send input commands and validate them server-side.
4. Run simulation on a controlled fixed-step loop.
5. Return snapshots and events through bounded outbound queues.
6. Add interpolation, then prediction and reconciliation if needed.
7. Add authentication, TLS, limits, heartbeats, and reconnects.
8. Test malformed input, slow clients, disconnects, latency, and loss.
9. Measure traffic and simulation cost before considering UDP or managed hosting.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.