What Is Traffic Scrubbing? How DDoS Protection Cleans Your Traffic Before It Reaches You

If you have shopped for DDoS protection, you have probably run into the word scrubbing. Providers say they scrub your traffic, run it through a scrubbing center, or hand back clean traffic. It sounds reassuring, but it usually arrives without any explanation of what actually happens or why it keeps a service online. This guide covers traffic scrubbing in plain terms: what it is, where the filtering takes place, how real visitors get separated from an attack, and what to check when a provider tells you they scrub your traffic. You do not need a networking background to follow along.

What traffic scrubbing actually means

Traffic scrubbing is the process of inspecting the traffic headed for your server, separating the junk from the real visitors, and forwarding only the clean part. The junk is thrown away. Everything that looks like a genuine request continues on to you.

The name is almost literal. Dirty water goes into a filter, clean water comes out, and the grit stays behind. With scrubbing, a mix of legitimate visitors and attack traffic goes in, ordinary visitors come out, and the flood is discarded.

This filtering usually happens in a dedicated part of a provider's network built for the job. That place is often called a scrubbing center, and the act of filtering is sometimes called mitigation, which is simply the industry word for reducing or stopping an attack. A scrubbing center has one purpose: soak up large amounts of hostile traffic and pass along only what is safe.

Why the cleaning cannot happen on your own server

The obvious question is why you cannot just filter the traffic yourself with a firewall on your server. For small nuisances, sometimes you can. The trouble starts with scale.

Many attacks work by sending more traffic than your internet connection can physically carry. Think of that connection as a pipe of a fixed width. On an ordinary day it comfortably carries your visitors. Point a flood at it that is wider than the pipe, and the pipe simply overflows. Real requests and attack traffic are lost together, and no rule you set on the server can change that, because the overflow happens upstream, before anything reaches you. Floods built to do exactly this are called volumetric attacks, and they are the reason on-server filtering alone falls short. They are one of several different types of DDoS attacks, and the one scrubbing is most clearly suited to.

So the filtering has to happen before the flood reaches your pipe. In practice that means it has to happen further out, inside a network with far more capacity than your own connection.

Filtering on your own connection runs out of room once it fills. Scrubbing upstream absorbs the flood first, so only clean traffic reaches you.

How your traffic gets to the scrubbing stage

For a scrubbing center to filter your traffic, that traffic has to pass through it first. The starting point of any scrubbing setup is therefore redirection. Instead of flowing straight to your server, traffic addressed to you is steered into the provider's network, filtered, and then the clean remainder is forwarded to you.

Traffic is routed through the scrubbing stage first, so the attack is dropped before clean traffic reaches your server.

There are a few common ways to move traffic through a scrubbing stage and deliver the clean result:

• A GRE tunnel, a private path over the public internet that carries filtered traffic to a single server or a small set of addresses. We cover this in more depth in the guide to GRE tunnel DDoS protection.
• A BGP announcement, which suits organizations that run their own blocks of IP addresses and want an entire network filtered at once.
• A reverse proxy, common for websites, where visitors connect to the provider's address and the provider passes clean requests on to your hidden server.
• Anycast DDoS protection, where the same protected address is reachable from many locations, so a flood is spread out and filtered close to where it enters rather than piling onto one point.

The delivery method changes, but the shape is the same every time. Traffic reaches the filtering first, the attack is dropped there, and only the survivors continue to you. One detail matters across all of these methods: once protection is in place, the real address your server sits on, often called the origin, should stay private. If an attacker learns it, they can aim straight at it and skip the scrubbing entirely. Keeping that origin address hidden is part of what makes scrubbing effective in the first place.

How scrubbing tells real visitors from an attack

Discarding traffic is easy. Discarding the right traffic, without throwing away real customers, is the hard part, and it is where providers differ. The exact methods belong to each network, but a few general ideas are common across the industry.

At a basic level, filtering looks at whether traffic behaves the way genuine traffic should. A common approach is to check that connections follow the normal rules of the protocol they claim to use, since many floods are made of malformed or half-finished connections that a real browser or game client would never send. Another is to watch volume and patterns, because a single source suddenly sending thousands of identical requests looks nothing like a crowd of real users. Recognizable attack patterns can be matched and dropped outright.

None of this is perfect, and honest providers do not pretend otherwise. Filtering that is too aggressive can catch real visitors by mistake, while filtering that is too gentle lets some attack traffic through. Good scrubbing is tuned to keep both problems small, and it tends to improve as it sees more traffic. What you are paying for is the judgment to tell the two apart accurately and at speed, not a switch that magically blocks everything bad and nothing good.

Why scrubbing has to be always on

A flood can fill a connection in seconds. That one fact shapes how useful scrubbing really is, because filtering only helps if it is already running when the attack starts. Protection that has to be switched on after someone notices a problem is working against a clock it usually loses. By the time an alert is read and mitigation is turned on, much of the downtime has already happened.

This is the split between always-on and on-demand protection, and it is worth understanding before you choose a provider. With always-on scrubbing, traffic is inspected continuously, so an attack is filtered from its first packets instead of after the damage. Sterile Networks includes always-on Layer 3 and Layer 4 mitigation with every plan. Layers 3 and 4 are the parts of a connection that handle addressing and transport, which is where volumetric floods operate, so filtering them continuously closes the gap that on-demand protection leaves open. For the full comparison, the guide on always-on and on-demand protection walks through the tradeoffs.

What to look for when a provider mentions scrubbing

Once you know what scrubbing is, a provider's claims are easier to weigh. You do not need to interrogate anyone about their internal filters. A handful of questions gets you most of the way:

• Does the filtering sit upstream, inside a network built to absorb large floods, rather than on your own server?
• Is it always on, or does it start only after an attack is noticed?
• Can it handle different kinds of attacks, not only the largest floods but also the ones aimed at connections and applications?
• How is the clean traffic delivered back to you, and does that method fit what you run, whether that is a single server, a website, or a whole network?
• Does your real server address stay hidden once protection is in place?

Sterile Networks' network and ASN protection follows this model directly: volumetric and protocol floods are absorbed upstream, and only clean traffic is handed back over a GRE tunnel or a BGP announcement. If you are weighing your options, a good place to start is naming what you need to protect, then reviewing the available protection plans or contacting the team to talk through your setup.

Scrubbing is not a magic shield, and no honest provider will promise that nothing ever gets through. What it does is move the fight to ground where you can actually win it: a network with room to absorb the flood, filtering that runs before the traffic reaches you, and a clean connection that keeps your service reachable while the attack burns itself out somewhere else.

Stay online. Stay Sterile.