How does a DDoS scrubbing center work?

Traffic is rerouted to a scrubbing center, usually via BGP or DNS changes. The center inspects packets, drops those matching attack patterns, and forwards clean traffic to the origin server.

Can a firewall stop a DDoS attack?

A firewall can block traffic from known-bad IP addresses, but it cannot absorb large volumetric floods. At high packet rates, the firewall itself becomes the bottleneck. Dedicated DDoS mitigation hardware or cloud scrubbing is needed for large attacks.

What is the difference between always-on and on-demand DDoS protection?

Always-on protection routes all traffic through a scrubbing service continuously, so mitigation begins immediately when an attack starts. On-demand protection activates only after an attack is detected, which means there is a short window before filtering begins.

What is DDoS Mitigation?

Q: What is DDoS mitigation?

DDoS mitigation is the process of detecting and filtering distributed denial-of-service attack traffic so that a targeted service stays available. Tools use techniques like traffic scrubbing, rate limiting, and behavioral analysis to separate attack packets from legitimate requests.

DDoS Mitigation is the practice of detecting and blocking distributed denial-of-service attacks before they exhaust a target's bandwidth, compute, or connection capacity. Tools in this category absorb or filter malicious traffic floods so that legitimate users can still reach a service.

What it does

A DDoS attack sends high volumes of traffic from many sources to overwhelm a target. Mitigation tools sit in the path of that traffic and filter it. Common techniques include:

Traffic scrubbing: routing traffic through a cleaning center that drops attack packets and forwards clean traffic.
Rate limiting: capping the number of requests a single source IP can send per second.
Anycast diffusion: spreading attack traffic across many points of presence so no single location is overwhelmed.
Behavioral analysis: building a baseline of normal traffic and flagging deviations, as seen in ML-based appliances.
Protocol inspection: examining Layer 4 and Layer 7 headers to block malformed or suspicious packets.
Simulation and testing: controlled attack replay to measure how well defenses hold before a real event.

Mitigation can be delivered as on-premises hardware appliances, virtual appliances, cloud scrubbing services, or hybrid combinations.

Why teams buy it

Downtime is expensive. A volumetric flood can take a public-facing service offline in minutes. ISPs and internet data centers face attacks measured in terabits per second. Application-layer attacks target specific URLs and are harder to spot with simple rate limits. Teams buy dedicated DDoS mitigation because general-purpose firewalls and next-generation firewalls are not designed to absorb large volumetric floods, and intrusion detection and prevention systems (IDPS) focus on exploit signatures rather than traffic volume.

What to look for

Capacity: how many Gbps or Tbps of attack traffic the service can absorb.

What is DDoS Mitigation?

What it does

Why teams buy it

What to look for

Common confusions

DDoS Mitigation tools

Frequently asked questions