A DDoS scrubber is a network security system designed to identify and remove malicious traffic during a DDoS attack while allowing legitimate traffic to reach its destination.
During a DDoS attack, large volumes of unwanted traffic can overwhelm a website, server or network connection, making services unavailable to legitimate users. A DDoS scrubber helps prevent this disruption by inspecting incoming traffic, filtering malicious packets and forwarding permitted traffic.
DDoS scrubbing is widely used by Internet Service Providers (ISPs), hosting providers, data centres and enterprises to protect their networks against network and transport-layer attacks.
Depending on the network architecture, scrubbing can take place locally using dedicated hardware or software, often called a "scrubber" or "inline scrubber" or through an external DDoS scrubbing provider, often called "cloud-based scrubbing centre".
How Does a DDoS Scrubber Work?
A DDoS scrubber acts as a traffic-cleaning system positioned in the path of incoming network traffic.
Its purpose is to distinguish traffic that should be allowed through from traffic that should be blocked or restricted.
Although the exact process varies by solution, DDoS scrubbing generally involves four stages.
1. Traffic Reaches the Scrubbing System
Traffic is directed through a DDoS scrubber, either because the scrubbing system is permanently deployed in the network path or because traffic has been redirected following an attack.
In an inline deployment, the scrubber continuously processes traffic passing through the network.
In a cloud-based deployment, routing changes can redirect traffic for an affected network prefix to an external scrubbing centre.
2. Traffic Is Inspected and Analysed
The scrubbing system examines incoming packets and applies its configured detection and filtering policies.
Depending on the solution, this may involve analysing:
- Source and destination IP addresses
- Network protocols, such as TCP, UDP and ICMP
- Source and destination ports
- Packet sizes and packet rates
- Traffic patterns and known attack characteristics
- Protocol behaviour and connection state, where supported
Some systems apply predefined filtering rules, while others also use traffic analysis and anomaly detection to identify suspicious behaviour.
The depth of inspection depends on the capabilities of the scrubbing technology.
3. Malicious Traffic Is Filtered
When traffic matches the system's mitigation rules, the scrubber can drop or rate-limit the relevant packets.
For example, a scrubber might block packets matching a known UDP amplification attack pattern while allowing other traffic to continue.
Filtering methods may include packet filtering, protocol-specific mitigation, rate limiting and, where supported, more advanced traffic inspection.
A scrubber does not necessarily identify every malicious packet correctly. Effective protection depends on the filtering rules, detection methods, configuration and attack characteristics.
4. Legitimate Traffic Is Forwarded
Once filtering rules have been applied, traffic that is permitted by the scrubbing system is forwarded towards the protected network or service.
For an inline scrubber, this typically means forwarding permitted packets along the local network path.
For an external scrubbing provider, the permitted traffic may be returned to the customer's infrastructure using a GRE tunnel, an IPsec tunnel or another configured connectivity method.
The goal is to maintain availability for legitimate users while reducing the amount of malicious traffic reaching the protected infrastructure.
What Types of DDoS Attacks Can a Scrubber Mitigate?
DDoS scrubbers are particularly important for defending against network and transport-layer attacks that generate large volumes of unwanted packets.
Common examples include:
| Attack type | How it works | How scrubbing can help |
| UDP flood | Overwhelms a target with large volumes of UDP packets | Filters or rate-limits traffic matching attack characteristics |
| TCP SYN flood | Sends large numbers of TCP connection requests to exhaust connection-handling resources | Applies SYN flood mitigation techniques, depending on the system |
| ICMP flood | Overloads a target with excessive ICMP traffic | Filters or rate-limits unwanted ICMP packets |
| Reflection and amplification attacks | Uses third-party services to generate large traffic volumes towards a victim | Identifies and filters reflected traffic using protocol and packet characteristics |
| Other packet floods | Overwhelms network links or processing equipment with large packet rates | Applies filtering rules to reduce malicious packet volume |
Some scrubbing providers also offer application-layer DDoS protection, including mitigation of HTTP floods.
However, application-layer protection is not a universal capability of all DDoS scrubbers. It may require additional proxy infrastructure, specialised inspection features or separate security services.
The available mitigation techniques depend on the scrubbing solution and its configuration.
Inline DDoS Scrubbing vs Cloud-Based DDoS Scrubbing
DDoS scrubbing can be implemented using different network architectures.
Two common approaches are inline scrubbing and external scrubbing centres.
Inline DDoS Scrubbing
With inline DDoS scrubbing, a filtering system is deployed directly in the network traffic path.
Incoming packets pass through the scrubber, which applies filtering rules and forwards permitted traffic to its destination.
Inline scrubbing can be implemented using specialised network appliances or software-based packet-processing systems running on commodity hardware.
This approach gives network operators direct control over their filtering infrastructure and can allow unwanted traffic to be dropped within their own network.
However, inline scrubbing has an important limitation: the malicious traffic must reach the filtering system before it can be removed.
If a DDoS attack saturates the upstream internet connection before reaching the inline scrubber, the protected network may still experience disruption.
For this reason, local inline scrubbing is often combined with upstream filtering or external mitigation capacity.
Cloud-Based DDoS Scrubbing Centres
A DDoS scrubbing centre is an external facility or service that filters traffic before forwarding permitted traffic to the protected network.
Scrubbing providers typically operate dedicated infrastructure with substantial network connectivity and mitigation capacity.
When traffic is directed to a scrubbing centre, malicious packets can be discarded within the provider's infrastructure rather than consuming bandwidth on the customer's network connection.
Clean traffic is then returned to the protected network through the configured connectivity path.
Cloud scrubbing is particularly useful when attacks exceed the bandwidth or mitigation capacity available locally.
External scrubbing can operate in two ways:
- Always-on scrubbing: Protected traffic continuously passes through the scrubbing provider.
- On-demand scrubbing: Traffic is diverted to the provider when an attack is detected and returned to normal routing when diversion is no longer required.
On-demand protection requires reliable attack detection, routing automation and an established clean-traffic return path.
For a more detailed explanation, read our guide to DDoS Scrubbing Centre Automation.
Comparing Inline and External DDoS Scrubbing
| Feature | Inline DDoS scrubber | External scrubbing centre |
| Deployment | Within the operator's network traffic path | At an external mitigation provider |
| Traffic filtering | Performed locally | Performed within the provider's infrastructure |
| Network capacity | Limited by local connectivity and processing resources | Depends on the provider's available mitigation capacity |
| Traffic redirection | Usually not required when permanently inline | May require BGP diversion or provider-specific routing |
| Infrastructure control | Managed by the network operator | Shared between the operator and scrubbing provider |
| Typical use case | Local packet filtering and network protection | Large-scale attacks requiring external mitigation capacity |
Neither approach is universally better. The appropriate architecture depends on network capacity, attack types, operational requirements and the level of control the organisation needs.
What Is a Line-Rate DDoS Scrubber?
A line-rate DDoS scrubber is a system designed to inspect and filter traffic at the full supported speed of its network interfaces under specified operating conditions.
For example, a scrubber connected to a 100 Gbps Ethernet interface may be described as line-rate capable if it can sustain packet filtering at that speed under the relevant test conditions.
Line-rate performance matters because filtering equipment must be capable of keeping up with incoming network traffic, particularly during high-volume DDoS attacks.
However, an advertised 100 Gbps or 400 Gbps interface does not automatically mean that the system can process every traffic pattern at that speed.
Actual filtering performance depends on several factors, including packet size, packet rate, filtering complexity, hardware resources and software architecture.
Two important measurements are:
- Gbps (gigabits per second): The amount of traffic processed per second.
- Mpps (million packets per second): The number of individual packets processed per second.
A system may handle large packets at full Ethernet line rate but struggle with small packets that require much higher packet-processing rates.
This makes packet-per-second performance particularly important when evaluating DDoS scrubbers and line-rate DDoS filters.
How FastNetMon Supports DDoS Scrubbing
FastNetMon provides real-time DDoS detection and automated mitigation capabilities for ISPs, hosting providers and data centres. Its technology supports different DDoS protection architectures, including automated diversion to external scrubbing centres and high-performance inline packet filtering.
With FastNetMon's scrubbing centre diversion automation, network operators can automatically redirect traffic to external scrubbing providers when attacks are detected. Meanwhile, FastACL, FastNetMon's open-source packet filtering engine built on FD.io VPP, enables high-performance inline DDoS filtering directly within the operator's own network infrastructure. Together, these technologies give network operators flexible options for detecting and mitigating DDoS attacks using local filtering, external scrubbing services or a combination of both.
Automated Diversion to External Scrubbing Centres
FastNetMon can detect DDoS attacks and automatically activate traffic diversion to supported external scrubbing providers.
Depending on the integration, this can involve BGP announcements or provider API calls.
Once the diversion is active, the external scrubbing centre filters incoming traffic and returns legitimate traffic to the protected network.
When the attack subsides, FastNetMon can trigger withdrawal of the diversion and restoration of normal routing.
This allows network operators to use external scrubbing capacity when required rather than permanently routing all protected traffic through a scrubbing centre.
Learn more about FastNetMon's automated DDoS scrubbing centre diversion.
Inline DDoS Filtering with FastACL
FastNetMon's ecosystem also includes FastACL Community, an open-source packet filtering engine built on FD.io VPP.
FastACL operates inline, applying packet-filtering rules to incoming traffic and forwarding permitted packets.
It can be combined with FastNetMon's detection capabilities to create a software-based DDoS mitigation architecture in which FastNetMon identifies attacks and FastACL enforces filtering rules.
This offers an alternative to relying exclusively on dedicated hardware appliances or external scrubbing providers for local traffic filtering.
FastACL's performance depends on the hardware, traffic profile and filtering configuration. Its published performance tests provide specific throughput and packet-rate measurements rather than a universal guarantee of line-rate processing under all conditions.
Learn more about FastACL Community and open-source DDoS scrubbing.
What Should You Consider When Choosing a DDoS Scrubber?
Choosing a DDoS scrubbing solution involves more than comparing advertised bandwidth capacities.
Network operators should evaluate several practical factors.
Mitigation capacity: Can the solution handle the expected attack volume without overwhelming the filtering infrastructure or available connectivity?
Packet-processing performance: Can the scrubber handle high packets-per-second rates, including attacks composed of small packets?
Detection and filtering capabilities: Which attack types can the solution identify and mitigate, and how are filtering policies configured?
Network integration: Can the solution work with the organisation's existing routers, BGP configuration and network architecture?
Deployment model: Is local inline filtering sufficient, or is external scrubbing capacity needed to handle attacks that exceed upstream bandwidth?
Automation: Can attack detection, mitigation activation and recovery operate automatically, or do they require manual intervention?
Operational visibility: Does the solution provide useful information about detected attacks, applied mitigation actions and traffic behaviour?
A suitable DDoS protection architecture may combine several mitigation techniques rather than rely on a single filtering system.
Conclusion
A DDoS scrubber protects networks by inspecting incoming traffic, removing packets that match malicious traffic patterns and forwarding permitted traffic towards its destination.
Scrubbing can be performed locally through inline filtering systems or externally through dedicated scrubbing centres.
Inline scrubbing offers direct control over traffic filtering, while external scrubbing providers can provide additional capacity when attacks exceed the bandwidth available to the protected network.
For ISPs, hosting providers, data centres and large enterprise networks, the most effective approach often combines reliable attack detection with appropriate filtering and mitigation infrastructure.
FastNetMon helps automate DDoS detection and mitigation, including traffic diversion to external scrubbing providers. FastACL extends the ecosystem with an open-source inline packet-filtering engine for building software-based DDoS mitigation systems.
Together, these technologies give network operators different options for designing DDoS protection around their existing infrastructure and operational requirements.
Explore FastNetMon's DDoS detection and mitigation solutions to learn more about protecting high-capacity networks.
