What is DDoS Scrubbing?

DDoS scrubbing is a traffic filtering technique used to protect networks from distributed denial-of-service attacks. It works by rerouting all inbound traffic through a scrubbing center, a dedicated facility equipped with high-capacity filtering hardware and software. The scrubbing center analyzes packets using methods such as rate limiting, IP reputation lists, signature detection, and behavioral analysis. Malicious packets are dropped, and clean traffic is sent back to the original destination via a tunnel, typically GRE or IPsec.

The redirection of traffic is usually achieved through BGP route announcements. When an attack is detected, the target network announces a more specific route to the scrubbing center, causing upstream routers to forward traffic there instead of directly to the target. After scrubbing, the clean traffic is reinjected into the network. This process can be triggered automatically by DDoS detection systems or manually by network operators.

DDoS scrubbing sits within the broader DDoS mitigation ecosystem, often as a managed service offered by cloud providers, ISPs, or security vendors. It complements other techniques such as anycast distribution, BGP Flowspec, and on-premise firewalls. Scrubbing centers are typically deployed in multiple geographic locations to absorb large volumetric attacks. The technique is effective against layer 3 and layer 4 floods but may also handle some application-layer attacks when combined with deep packet inspection.