How scrubbing works
When an attack is detected, traffic for the protected prefix is routed through a scrubbing platform. It identifies and drops malicious packets while passing legitimate traffic, which is then forwarded to your network.
On-demand vs always-on
- On-demand: traffic is diverted only during attacks. Lower cost, a short delay to engage.
- Always-on: traffic always passes through scrubbing. Immediate protection, slight latency added.
Choosing
Critical services that cannot tolerate any downtime benefit from always-on. Others can use on-demand with automated detection.
Prefix size
Diversion usually works at /24 granularity for IPv4, as smaller prefixes may not propagate globally. Plan your addressing with that in mind.
Part of a layered approach
Combine scrubbing with blackholing for emergencies and flowspec for targeted filtering.
