What is a scrubbing center?

A scrubbing center is infrastructure that traffic is passed through during a DDoS attack in order to separate attack packets from real user traffic. Whatever survives filtering is returned to the customer network and the rest is dropped. Two questions matter most with this kind of service: when the traffic reaches the center, and whose infrastructure it is.

Always-on versus on-demand

In the always-on model traffic passes through the filter permanently, so mitigation has no starting moment. Nothing has to be detected or switched over, because the defence is already working. In the on-demand model traffic takes its normal path and only reaches the center once an attack is detected, usually by announcing the prefix over BGP towards the protection provider. It is cheaper, but it has a delay built in: you have to detect the attack, divert the traffic and wait for BGP convergence, and those tens of seconds or few minutes are usually enough for users to notice an outage.

How the traffic gets back

Once cleaned, the traffic has to be delivered to the destination network, and this is the part that is easy to overlook when signing a contract. The usual methods are a GRE tunnel, a dedicated link, or a cross-connect if both parties share a location. A tunnel means an extra header, therefore a smaller MTU and a risk of fragmentation, plus one more component that can fail. The return path can also be far longer than the original one, especially when the scrubbing center sits in another country.

Whose infrastructure is it

Scrubbing run by an operator inside their own network is a different proposition from a service bought from an external global provider. In the first case the traffic stays in the same network that carries it anyway and the path stays short. In the second it is handed to a third party, often to infrastructure abroad, which has consequences for latency, for visibility in troubleshooting, and for who is actually looking at your users' data.

It is also worth checking what a provider's declared presence in your country really is. A global company can list a local point of presence that in practice is one satellite node hanging off a single uplink to their own backbone, with the real filtering capacity somewhere else entirely. When that uplink fills up, traffic goes back onto a foreign path.

What scrubbing does not solve

• It does not help if the attack saturates the link before the point where traffic is intercepted. The filter has to sit above the bottleneck.
• In the on-demand model it protects nothing during detection and BGP convergence, usually the most expensive minutes of the attack.
• Against carpet bombing it requires diverting the whole prefix, so customers nobody is attacking also come off their normal path.
• Encrypted layer 7 traffic needs separate arrangements, because without access to request content application filtering is limited.