A Scrubbing Centre works by diverting suspicious traffic to an upstream facility that filters out attack traffic and forwards clean traffic to the destination. It is used during volumetric and protocol floods, including reflection attacks. Defenders should test diversion, routing failover, capacity, and the criteria used to trigger scrubbing.
How a Scrubbing Centre Fits Into DDoS Mitigation
A scrubbing centre is an upstream filtering point, not a magic shield. Traffic is diverted to a facility with higher capacity and specialised detection, where malicious packets are removed and legitimate traffic is forwarded onward. The important design question is whether diversion happens early enough to protect the origin service without breaking routing, latency, or availability expectations.
The model works best when the organisation already knows what “good” traffic looks like and can distinguish floods from normal spikes. That distinction matters because scrubbing is most effective when the defender can trigger it before the target exhausts bandwidth, state tables, or upstream links. For background on the wider mitigation pattern, see the DDoS Protection Guide.
What Gets Filtered and What Still Needs to Pass Through
Scrubbing centres are typically used for volumetric attacks, protocol floods, and reflection-based abuse. The facility inspects packet rate, protocol behaviour, source patterns, and sometimes application signatures, then drops or rate-limits traffic that matches the attack profile. Clean traffic is forwarded back to the origin through a protected path, often after normalisation or re-encapsulation.
The practical limitation is that the defender is still trusting the classification logic. If the threshold is too sensitive, legitimate bursts can be removed or delayed. If it is too loose, the origin remains exposed to exhaustion. That is why routing policy, anycast design, and the scrubbing provider’s capacity all matter as much as the filtering rules themselves.
Why Trigger Criteria and Failover Testing Matter
Scrubbing only helps if the diversion trigger is reliable. Many teams discover too late that they have documented the mitigation path but never tested how traffic actually shifts under stress, how quickly routes converge, or what happens if the preferred clean path fails. A sound implementation includes agreed trigger thresholds, routing failover behaviour, and a clear rollback path if scrubbing causes collateral damage.
It is also worth validating that the facility can sustain the peak attack class you expect. Reflection floods and protocol floods can produce very different traffic shapes, so a single “DDoS mode” assumption is not enough. The operational test is whether the destination stays reachable while the upstream service absorbs the attack, not whether the dashboard reports that scrubbing is enabled.
Risk and Threat Considerations
Scrubbing centres reduce exposure to bandwidth exhaustion, but they also introduce dependence on upstream routing and the provider’s detection quality. If diversion is slow, misconfigured, or capacity-constrained, the attack can still saturate links before clean traffic is restored.
Failure mechanism: Attack traffic overwhelms the origin or the diversion path before the scrubbing decision takes effect, or legitimate traffic is filtered out because the attack profile is too broad.
Impact: The service remains unavailable or partially impaired, and recovery may take longer if the organisation has not rehearsed route changes, failback, and exception handling under live load.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-13 — Data Recovery | Scrubbing centres support availability recovery during disruptive attacks. |
| Recommendation — Test diversion and failover so attack traffic can be absorbed without prolonged service loss. | ||
| NIST CSF 2.0 | RS.MA-01 — Mitigation is performed | This subject is about active mitigation of live DDoS traffic. |
| RC.RP-01 — Recovery plan is executed during or after an incident | Scrubbing relies on rehearsed diversion and failback during attack conditions. | |
| Recommendation — Execute mitigation actions that redirect and filter attack traffic during an event. Rehearse recovery steps that restore clean traffic paths after diversion. | ||
| NIST SP 800-53 Rev 5 | SC-5 — Denial of Service Protection | Scrubbing centres are a denial-of-service protection mechanism against floods. |
| SC-7 — Boundary Protection | Diversion and filtering depend on controlling ingress and egress paths. | |
| Recommendation — Implement DOS protections that absorb or filter flood traffic before it reaches the service. Enforce boundary filtering and routing controls that separate attack traffic from clean traffic. | ||
Practitioner Guidance
What to verify: Confirm that the diversion trigger is based on measurable conditions, not informal judgement. You should be able to demonstrate when scrubbing starts, which routes are preferred, and how quickly clean traffic is restored after a false positive or a provider failure.
What good looks like: The origin stays reachable during a flood, normal traffic is preserved where possible, and the team can prove that the mitigation path works under load rather than only on paper. A mature setup also has a tested threshold for escalating from partial filtering to full diversion.
Practitioner takeaway: Treat scrubbing as an operational control with failure modes, not just a service feature, because its value depends on trigger accuracy, route stability, and the provider’s ability to absorb the attack class you are defending against.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org