DDoS scrubbing centre automation is the process of automatically redirecting network traffic to a scrubbing provider when a DDoS attack is detected. Instead of routing traffic through a scrubbing centre permanently, on-demand diversion activates protection when needed, helping network operators maintain efficient routing during normal operation.
FastNetMon automates DDoS scrubbing centre diversion by detecting attacks in real time and triggering routing changes or integrations with scrubbing providers. The scrubbing centre then filters malicious traffic and forwards legitimate traffic back to the protected network.
For Internet Service Providers (ISPs), hosting companies, data centres and other network operators, this approach combines automated threat detection with the mitigation capacity of dedicated scrubbing infrastructure.
In this article, we'll explain how DDoS scrubbing centres work, how automated diversion operates, and how FastNetMon helps organisations respond to attacks without permanently routing their traffic through an external scrubbing provider.
What Is a DDoS Scrubbing Centre?
A DDoS scrubbing centre is a dedicated network facility or cloud-based service designed to protect networks against DDoS attacks by separating malicious traffic from legitimate traffic.
During a DDoS attack, an attacker attempts to overwhelm a target network, server or application with excessive traffic. Large volumetric attacks can consume available bandwidth, overwhelm network equipment or disrupt services for legitimate users.
A scrubbing centre provides an additional layer of protection by receiving traffic destined for the protected network, identifying malicious packets and dropping them before they reach the customer's infrastructure.
Depending on the provider and its mitigation capabilities, DDoS scrubbing centres may use several techniques to identify and filter malicious traffic, including:
- Packet filtering: Dropping traffic based on characteristics such as source or destination IP addresses, protocols, ports and known attack patterns.
- Protocol-based mitigation: Identifying and blocking traffic associated with network and transport-layer attacks, including UDP floods, TCP SYN floods and reflection or amplification attacks.
- Traffic analysis and anomaly detection: Analysing traffic patterns and packet rates to identify suspicious activity and determine which mitigation rules to apply.
- Rate limiting: Restricting traffic that matches specific conditions to prevent excessive traffic from overwhelming protected infrastructure.
Some scrubbing providers also offer application-layer DDoS protection, such as mitigation of HTTP floods, through additional services or specialised inspection capabilities. The exact techniques available depend on the scrubbing provider, its infrastructure and the protection services enabled.
Once malicious traffic has been removed, the scrubbing centre forwards legitimate traffic to the protected destination.
Scrubbing providers often operate high-capacity, geographically distributed infrastructure designed to absorb attacks that could otherwise exceed the bandwidth available to an individual organisation.
However, using a scrubbing centre does not necessarily mean that all network traffic must pass through it permanently.
External DDoS Scrubbing vs Inline DDoS Scrubbing
While external scrubbing centres provide additional mitigation capacity by redirecting traffic to a dedicated provider, inline DDoS scrubbing offers another approach to protecting networks against malicious traffic.
With inline scrubbing, a filtering system is deployed directly in the network's traffic path. Instead of sending traffic to an external provider, the system inspects incoming packets, drops traffic matching malicious patterns, and forwards permitted traffic towards its destination.
Both approaches have different advantages:
- External scrubbing centre diversion: Redirects traffic to a specialised provider with additional mitigation capacity. This is particularly useful when an attack exceeds the bandwidth available to the protected network.
- Inline DDoS scrubbing: Filters traffic within the network infrastructure, allowing operators to apply mitigation policies locally without necessarily relying on an external scrubbing provider.
FastNetMon supports these approaches through different technologies.
For external scrubbing, FastNetMon detects DDoS attacks and automates traffic diversion using BGP announcements or supported provider integrations.
For inline filtering, FastACL Community is an open-source packet filtering engine built on FD.io VPP. It applies filtering rules directly to packets passing through the system, dropping identified attack traffic while forwarding permitted traffic.
Combined with FastNetMon's detection capabilities, FastACL provides a foundation for building a high-performance, software-based DDoS scrubbing system on commodity hardware
Learn more about FastACL Community and its inline DDoS filtering capabilities.
What Is DDoS Scrubbing Centre Diversion?
DDoS scrubbing centre diversion is the process of redirecting traffic for selected IP prefixes through a scrubbing provider so malicious traffic can be filtered before reaching the protected network.
There are two common deployment models.
Always-On DDoS Scrubbing
With always-on scrubbing, protected traffic continuously passes through the scrubbing provider, regardless of whether an attack is occurring.
This means the scrubbing infrastructure is already in the traffic path when an attack begins. There is no need to wait for an additional routing change to activate the scrubbing path.
Always-on scrubbing can be useful for organisations that require continuous inspection or want to avoid the delay associated with activating on-demand traffic diversion.
However, the model also introduces considerations around routing, infrastructure dependencies and cost.
Depending on the scrubbing provider's network and location, routing traffic through an external service may introduce additional latency or complexity. Commercial pricing also varies between providers and service agreements.
On-Demand DDoS Scrubbing
With on-demand scrubbing, network traffic follows its normal routing path until an attack is detected.
When an attack occurs, traffic for the affected IP prefix is redirected to a scrubbing centre. The provider filters malicious packets and forwards legitimate traffic to the protected network.
Once the attack has ended and the configured mitigation conditions have been satisfied, traffic diversion can be withdrawn, allowing traffic to return to its normal path.
This approach is particularly relevant to ISPs, hosting providers and data centres that want to use external scrubbing capacity during attacks without continuously diverting their traffic.
The main challenge is ensuring that attacks are detected quickly and that traffic diversion can be activated reliably.
This is where FastNetMon comes in.
How FastNetMon Automates DDoS Scrubbing Centre Diversion
FastNetMon is a DDoS detection and mitigation solution that monitors network traffic and can automatically trigger mitigation actions when attacks are identified.
When integrated with a scrubbing provider, FastNetMon acts as the detection and automation component of an on-demand DDoS protection architecture.
Rather than performing the cloud scrubbing itself, FastNetMon identifies the attack and initiates the configured diversion process. The scrubbing provider is responsible for filtering the redirected traffic.
The process involves four main stages.
1. Real-Time DDoS Attack Detection
FastNetMon continuously analyses network traffic using telemetry sources such as NetFlow, sFlow and IPFIX.
It monitors traffic characteristics including bandwidth consumption, packet rates and flow rates, helping network operators identify unusual patterns that may indicate a DDoS attack.
For example, if a server normally receives a moderate volume of UDP traffic but suddenly experiences a substantial increase in packets per second, FastNetMon can evaluate that traffic against its configured detection criteria.
When the traffic exceeds the relevant thresholds or matches configured attack detection conditions, FastNetMon can trigger a mitigation action.
This automation reduces the need for network engineers to identify an attack manually and then make emergency routing changes.
Detection speed depends on factors such as the telemetry source, export intervals, sampling configuration, attack characteristics and detection settings.
2. Automatic Traffic Diversion
Once an attack is detected, FastNetMon can initiate traffic diversion using the mitigation method supported by the network and scrubbing provider.
Common approaches include:
BGP Unicast announcements
FastNetMon can announce the affected network prefix with the appropriate routing attributes or BGP communities.
Depending on the upstream routing policies and scrubbing provider's configuration, these announcements can trigger the diversion of inbound traffic to the provider's scrubbing infrastructure.
Scrubbing provider API integrations
FastNetMon can also integrate with supported scrubbing providers through their APIs.
When an attack is detected, FastNetMon can trigger the configured integration to request diversion or activate protection for the affected prefix. Once mitigation is no longer required, the integration can remove that request.
For example, FastNetMon Advanced supports integrations with DDoS protection providers including Gcore and Cloudflare Magic Transit.
3. DDoS Traffic Scrubbing and Clean Traffic Return
After diversion has been activated and the relevant routing changes have taken effect, inbound traffic for the diverted prefix reaches the scrubbing provider.
The scrubbing centre inspects the traffic and applies its mitigation policies.
Malicious traffic is discarded or otherwise mitigated, while legitimate traffic is forwarded towards the protected network.
The clean traffic is commonly returned through a preconfigured GRE tunnel, an IPsec tunnel or another connectivity method supported by the provider.
It is important to distinguish between the two directions of traffic:
- Inbound diversion: BGP routing changes or provider-specific routing mechanisms direct incoming traffic towards the scrubbing centre.
- Clean traffic return: The scrubbing provider forwards filtered traffic back to the protected network over the configured return path.
FastNetMon controls the automated activation of diversion through the configured integration. It does not itself establish or operate the scrubbing provider's traffic-cleaning infrastructure.
4. Automatic Withdrawal and Routing Restoration
Once the attack has subsided and the configured mitigation conditions have been met, FastNetMon can automatically deactivate the diversion.
Depending on the integration, this may involve withdrawing a BGP announcement or sending an API request to the scrubbing provider.
The network then returns to its normal routing state as the relevant routing changes propagate.
This automated recovery process helps reduce the operational work associated with manually enabling and disabling external DDoS protection.
Always-On vs On-Demand DDoS Scrubbing
Both always-on and on-demand scrubbing can provide effective DDoS protection. The best choice depends on the organisation's traffic patterns, performance requirements and risk tolerance.
| Feature | Always-On Scrubbing | On-Demand Scrubbing with FastNetMon |
| Traffic routing | Protected traffic continuously passes through the scrubbing provider | Traffic is diverted when configured attack conditions are met |
| Attack detection | Provider protection is already in the traffic path | FastNetMon detects attacks and triggers diversion |
| Activation delay | No additional diversion activation required | Depends on detection, provider activation and routing convergence |
| Normal-state latency | Depends on scrubbing provider location and network routing | Traffic normally avoids an external scrubbing detour |
| Attack mitigation capacity | Depends on the scrubbing provider | Depends on the selected scrubbing provider |
| Operational costs | Determined by the provider's commercial model | May reduce usage-based costs, depending on the agreement |
| Traffic inspection | Protected traffic passes through the scrubbing system continuously | Traffic for diverted prefixes passes through the scrubbing system during mitigation |
| Routing complexity | Scrubbing path must remain operational continuously | Diversion activation, withdrawal and clean-traffic return must be configured and tested |
| Primary advantage | Protection infrastructure is already in the traffic path | Normal traffic routing is preserved when diversion is not required |
Always-on scrubbing can be a strong choice for organisations that prioritise continuous inspection or cannot tolerate the time needed to activate traffic diversion.
On-demand scrubbing is attractive for network operators that want to maintain normal routing most of the time while retaining access to external mitigation capacity during attacks.
FastNetMon helps automate the second approach by reducing the manual steps involved in identifying attacks, activating diversion and restoring normal routing.
Benefits of Automating DDoS Scrubbing Centre Diversion
For network operators with an appropriate routing architecture, automated on-demand scrubbing offers several practical advantages.
Faster Operational Response
Manually identifying a DDoS attack, contacting a scrubbing provider and changing network routing can consume valuable time.
FastNetMon automates detection and the configured mitigation trigger, reducing dependence on manual intervention.
The total time required for protection to become effective still depends on provider activation and routing convergence.
Normal Routing During Non-Attack Periods
Traffic does not need to pass through an external scrubbing provider continuously.
During normal network operation, protected traffic can follow the organisation's established routing paths, avoiding an unnecessary diversion through the scrubbing infrastructure.
Access to Additional Mitigation Capacity
Large DDoS attacks can exceed the capacity of an individual hosting provider or ISP connection.
Automated diversion allows network operators to use an external scrubbing provider's mitigation infrastructure when an attack requires additional protection.
The available mitigation capacity depends on the selected provider and service agreement.
More Targeted Traffic Diversion
Rather than permanently redirecting all network traffic, on-demand scrubbing can be activated for selected affected prefixes.
This helps reduce unnecessary use of external scrubbing infrastructure, although other legitimate services within the diverted prefix may also be routed through the provider.
Potential Cost Efficiency
For organisations whose scrubbing provider offers a suitable pricing model, on-demand diversion may reduce traffic-based operating costs compared with continuous scrubbing.
However, savings depend on the provider's contract, reserved capacity, subscription fees and traffic-based charges.
Reduced Manual Network Operations
FastNetMon can automate the mitigation lifecycle, from attack detection and diversion activation through to withdrawal and routing restoration.
This reduces the number of manual routing changes required during an incident and allows network engineers to focus on investigating attacks and maintaining service availability.
Automate DDoS Scrubbing Centre Diversion with FastNetMon
DDoS scrubbing centres provide valuable protection against large-scale attacks, but the effectiveness of an on-demand deployment depends on how quickly and reliably traffic can be redirected.
FastNetMon connects real-time DDoS detection with automated mitigation actions, helping ISPs, hosting providers and data centres activate scrubbing centre protection when required.
By combining traffic analysis with BGP-based diversion and supported scrubbing provider integrations, FastNetMon enables network operators to:
- Detect abnormal traffic patterns and DDoS attacks in real time.
- Trigger diversion for affected network prefixes.
- Integrate with external DDoS scrubbing services.
- Restore normal routing automatically when mitigation is no longer required.
- Maintain visibility and operational control over the mitigation workflow.
The result is a flexible approach to DDoS defence that combines FastNetMon's detection and automation capabilities with the filtering capacity of dedicated scrubbing infrastructure.
To learn more, explore FastNetMon's BGP traffic diversion capabilities or discover how FastNetMon integrates with supported DDoS scrubbing providers.
Looking to automate DDoS scrubbing centre diversion in your network?
Contact the FastNetMon team to discuss your network architecture, mitigation requirements and available integration options.
