Traffic rerouting is the process of sending network or application traffic along a different path than usual. It is used in routing, load balancing, failover, and maintenance to move requests between servers, regions, or links when paths change or fail.
How Traffic Rerouting Works
Traffic rerouting changes the path a request takes through the network or application stack, usually because an upstream path is unavailable, congested, under maintenance, or deliberately shifted for resilience. It is a control-plane or routing decision, not a change to the content of the traffic itself.
At a practical level, rerouting can happen through DNS updates, load balancer changes, BGP path selection, service mesh policy, application gateway rules, or manual operator intervention. The important idea is that the destination experience stays as consistent as possible while the underlying path changes.
Why Traffic Rerouting Matters
Rerouting is one of the main mechanisms that keeps services reachable when infrastructure changes or fails. It supports failover, disaster recovery, capacity balancing, regional maintenance, and traffic engineering, especially in distributed systems where a single path or site is a brittle dependency.
Because rerouting changes where traffic flows, it can also change latency, packet loss, session continuity, and regulatory or operational boundaries. In some environments, the chosen path affects whether traffic crosses zones, regions, or providers, so the reroute decision can have compliance and performance consequences as well as availability benefits.
Common Forms of Rerouting
Different environments reroute traffic in different ways, but the underlying goal is the same: move requests without breaking service unnecessarily.
- DNS-based rerouting, where names resolve to a different endpoint or region.
- Load balancer rerouting, where requests are shifted between healthy backends.
- Routing-protocol rerouting, where the network prefers a different path after a failure or policy change.
- Application-layer rerouting, where gateways, proxies, or service meshes steer calls to another service instance.
These methods are often combined. For example, an application may fail over at the load balancer level while the network also converges on a new route underneath.
Security and Operational Effects
Traffic rerouting is usually introduced for resilience, but it can also change the attack surface. A rerouted path may traverse different devices, security controls, logging points, or trust zones, which means visibility and policy enforcement can change even when the service name stays the same.
It also affects detection and troubleshooting. If routing changes are not tracked carefully, defenders may misread a legitimate reroute as service instability, or miss that traffic has moved through a path with weaker inspection or different access rules.
Risk and Threat Considerations
Rerouting can create exposure when the alternate path is less well controlled than the original one, or when route changes are made without strong validation. If an attacker can influence routing, DNS, or failover decisions, they may redirect users to malicious infrastructure, suppress monitoring, or place traffic on a path with weaker security controls.
Failure mechanism: A failover or routing change can bypass expected inspection, shift traffic into a less trusted segment, or preserve a bad path long enough for users and operators to treat it as normal.
Impact: The result can be service disruption, session loss, data exposure, degraded integrity, or hidden compromise if the rerouted path weakens monitoring or trust assumptions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RC.RP-01 — Recovery Plan Execution | Traffic rerouting is a recovery action used to restore service continuity after path failure. |
| PR.IR-01 — Network Resilience | Rerouting depends on resilient network paths and alternate communications channels. | |
| Recommendation — Exercise rerouting procedures so failover restores service without breaking dependencies or monitoring. Design alternate paths and redundancy so traffic can shift safely during outages or maintenance. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Rerouting changes which boundaries traffic crosses and which protections inspect it. |
| CM-3 — Configuration Change Control | Route changes, DNS updates, and failover policy changes require controlled change management. | |
| Recommendation — Enforce boundary protections on every viable path that rerouted traffic can take. Review and approve rerouting changes before they alter production traffic paths. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | Traffic rerouting is a network infrastructure operation that depends on controlled routing and redundancy. |
| Recommendation — Maintain and test routing, failover, and segmentation settings so alternate paths behave as intended. | ||
Practitioner Guidance
Why practitioners should care: Treat rerouting as a change in control boundaries, not just a connectivity event. The safest reroute is the one that preserves service while keeping policy enforcement, logging, and health checks aligned with the new path.
What to watch for: Validate that failover targets, DNS records, routing policies, and load balancer pools are monitored together, because inconsistent state across those layers is a common source of confusing outages and weak failover behaviour.
Practitioner takeaway: Good rerouting design makes path changes observable, reversible, and boring during an incident, which is exactly what operators want.
Related resources from NHI Mgmt Group
- When should organisations block anonymous network traffic at login?
- How should teams rotate JWT signing keys without breaking production traffic?
- What is the difference between securing V2X traffic and securing automotive identities?
- What is the difference between routing traffic and governing identity at the edge?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org