Join our Newsletter — 33% off our NHI Course

Scrubbing Centre

A Scrubbing Centre is a traffic filtering facility that removes malicious or unwanted traffic, especially volumetric DDoS traffic, before forwarding clean traffic to the target. Security teams monitor diversion triggers, routing changes, and clean-traffic handoff so the centre does not become a single point of failure or a bottleneck.

How a Scrubbing Centre Works

A scrubbing centre is usually inserted into a traffic path when an organisation needs to absorb and filter attack traffic before it reaches the origin service. It sits between the internet and the protected target, so its main value is the ability to separate hostile floods from legitimate requests without taking the service offline.

That filtering role depends on accurate diversion and clean return routing. If traffic is not steered to the centre at the right time, or if clean traffic is not handed back correctly, the protection layer can become part of the outage rather than the remedy.

Why It Matters for DDoS Resilience

The term is most closely associated with volumetric DDoS defence, where the objective is to absorb large floods that would otherwise overwhelm links, firewalls, load balancers, or application front ends. A scrubbing centre gives defenders a dedicated place to discard malformed, excessive, or clearly abusive traffic before the target is forced to process it.

Its effectiveness comes from scale and specificity. Generic perimeter controls may help with small spikes, but they are often not enough against traffic volumes designed to saturate bandwidth or exhaust state. A dedicated scrubbing layer can apply traffic profiling, rate controls, protocol validation, and route manipulation at a scale that the origin environment cannot safely sustain on its own.

Operational Signals and Failure Points

Scrubbing is not a fire-and-forget control. Teams need visibility into diversion triggers, anycast or reroute events, traffic profiles, and the point at which cleansed traffic rejoins the normal path. Those operational signals show whether mitigation is active, whether legitimate traffic is being preserved, and whether the centre is performing within its intended capacity.

Common failure points are over-scrubbing, under-scrubbing, and routing instability. Over-scrubbing can drop legitimate users, under-scrubbing can let the attack through, and unstable route changes can create latency, packet loss, or asymmetric paths that are hard to troubleshoot.

Because a scrubbing service sits on a critical path, it must be treated as a resilience dependency, not just a protective add-on. Many of the same concerns discussed in the DDoS Protection Guide apply here, especially around routing design, fallback behaviour, and clean-traffic handoff.

Design and Governance Considerations

Scrubbing centres work best when they are paired with clear activation criteria, tested failover paths, and a documented runbook for when mitigation must be escalated or withdrawn. Organisations should understand who can trigger diversion, how quickly traffic can be redirected, and what monitoring proves that the mitigation layer is actually protecting the service.

They should also plan for the possibility that the mitigation service itself becomes constrained. That means deciding whether protection is provided through a third-party service, a cloud edge, or an in-house capability, and then validating capacity, change control, and recovery assumptions before an incident forces the issue.

For broader resilience planning, the NCSC’s Advice and Guidance is a useful reference point for operational security decisions that affect service continuity.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
CIS Controls v8 CIS-12 — Network Infrastructure Management Scrubbing centres depend on controlled routing and network handling
Recommendation — Segment traffic paths and document diversion controls for DDoS mitigation.
NIST CSF 2.0 PR.PS-05 — Asset Management and Secure Configuration Scrubbing centres require resilient configuration and monitored traffic handling
RC.RP-01 — Recovery Plan Execution Clean-traffic handoff and failback are part of recovery during attack conditions
DE.CM-01 — Network Monitoring Diversion triggers and traffic anomalies must be observed to verify scrubbing is active
Recommendation — Harden and monitor the routing and mitigation configuration that protects service availability. Test the restore path so protected services return cleanly after mitigation. Monitor traffic patterns for diversion events and mitigation effectiveness.