How DDoS Scrubbing Works: What Happens When Traffic Hits a Mitigation Node

How does DDoS scrubbing work? Q&A on how scrubbing centers attract attack traffic, multilayer filters that separate good from bad, false-positive control, scrubbing vs WAF roles, and selection advice for small-to-mid sites.

DDoS scrubbing is the core of anti-DDoS service. Many operators only know they "bought high-defense," not how attack traffic is actually stripped. Q&A on scrubbing mechanics, the full attack-traffic pipeline, false-positive control, and scrubbing vs WAF—so you can judge whether your business should onboard.

What Does DDoS Scrubbing Mean?

DDoS scrubbing (Scrubbing): aggregate inbound traffic at dedicated mitigation nodes, strip attack traffic, forward only clean traffic to origin. Like a water plant: raw water has potable water and silt; the scrubbing center filters the silt.

Scrubbing runs at carrier or cloud-provider DCs: Tbps cluster bandwidth plus traffic fingerprinting. A single server cannot do this.

How Is Attack Traffic "Attracted" to Scrubbing Nodes?

Primary method: BGP diversion. Your domain resolves to an anti-DDoS IP announced by the scrubbing center:

• Steady state: scrubbing node forwards to origin; added latency is small
• On attack: BGP attracts routes for the targeted IP into the scrubbing cluster
• After filtering, traffic is reinjected to origin via tunnel or private line

Correct high-defense posture: origin allows only the scrubbing node's origin-pull IP ranges. Direct public scans of the real origin IP should fail. Otherwise attackers bypass mitigation and hit origin; scrubbing is wasted.

How Does the Scrubbing Center Separate Good Traffic from Attack Traffic?

Not a single rule. Multilayer filters stacked:

• Fingerprint filter: SYN Flood, UDP Flood have clear protocol fingerprints; malformed packets dropped
• Rate and session limits: thresholds on per-IP new-connection rate and concurrent sessions
• Signature match: known attack-tool payloads blocked
• Behavior analysis: baseline normal traffic for mixed attacks; deviations blocked
• Human verification: JS challenge or captcha on suspicious HTTP

The pipeline typically finishes in seconds. The longer DDoS traffic sits, the larger the business loss.

Will Scrubbing Block Legitimate Users?

False positives are the core tradeoff. Three mitigations:

• Allowlist: search-engine crawlers, payment callbacks, partner API IPs and fingerprints pass
• Staged policy: loosen after attack abates; don't challenge everything
• Captcha/JS challenge: a real person clicks through; reachability preserved, UX hit only

Operator advice: before onboarding, compile a must-pass list (search engines, callbacks, office egress IPs) and give it to the provider. Cuts false positives.

Can Scrubbing Stop Every DDoS Type?

No. Effectiveness varies:

• Volumetric (UDP Flood, reflection/amplification): best—bandwidth advantage plus fingerprint filter
• Protocol (SYN Flood, ACK Flood): good—scrubbing node completes handshake for the server
• Application (HTTP Flood, CC): scrubbing drops obvious anomalies; low-and-slow simulated CC belongs to WAF rate controls and business rules. Complementary, not substitutes.

Are Scrubbing and WAF the Same? Do You Need Both?

No. Different jobs:

• Scrubbing: network-layer floods; keep the link and server alive
• WAF: application-layer malice; stop SQLi, CC, malicious crawlers that look normal and behave wrong

Typical stack: anti-DDoS (with scrubbing) + WAF. DDoS doesn't kill the link; WAF covers CC and exploit traffic. Budget-constrained SMB sites: pick a CDN/WAF with CC protection (e.g. Baidu Cloud WAF) over bare anti-DDoS bandwidth.

Why Can't You Just Buy a Hardware Firewall?

Bandwidth mismatch. DDoS easily hits tens to hundreds of Gbps. A single server's DC uplink is typically hundreds of Mbps to a few Gbps. Attack fills the pipe before it reaches your box; neighbors suffer; the DC likely blackholes your IP. Scrubbing centers exist to absorb floods with Tbps clusters. Local hardware firewalls fit small-volume, slow attacks only.

Additional Recommendations

• Hide origin IP: scrub historical DNS records so attackers cannot recover the real IP from DNS history
• Drill failover: after onboarding, periodically test the app; don't wait for a real attack to find a misconfig
• Monitor/alert: watch scrubbing-console traffic curves and block logs; know at attack start
• Preserve evidence: attack screenshots and logs for police reports and carrier appeals