Security
What is Traffic scrubbing?
Scrubbing routes traffic through filtering infrastructure that discards attack packets and forwards legitimate ones. Always-on scrubbing filters continuously; on-demand scrubbing diverts traffic only once an attack is detected, which means the first minutes of every attack succeed.
Why Traffic scrubbing matters
Always-on scrubbing filters continuously; on-demand scrubbing diverts traffic only once an attack is detected, which means the first minutes of every attack succeed.
Traffic scrubbing in practice
Traffic scrubbing in practice means your provider's edge diverts your traffic through filtering hardware when attack traffic is detected, discarding packets that match attack patterns and forwarding the rest to your instance. You monitor your inbound packet rates and connection states to see if scrubbing is engaging or if legitimate traffic is being dropped. Changing routes, null-routing bad sources, or adjusting port filters is done at the panel or API. If you get it wrong, you either accept attack traffic or lose legitimate requests, with the first minutes of an on-demand attack succeeding until detection triggers scrubbing.
What people get wrong about Traffic scrubbing
A common mistake is assuming scrubbing is a switch you can flip when an attack starts. The misconception: 'I'll enable scrubbing when I see trouble.' The correction: always-on scrubbing filters continuously, so it engages without your action. On-demand scrubbing only diverts after detection, meaning the first minutes of every attack succeed. Configure your always-on protection and test its responsiveness before you need it.
Traffic scrubbing — common questions
Does traffic scrubbing slow down my server?
Scrubbing can add slight latency because your traffic takes an extra hop through filtering infrastructure. For most use cases, the impact is negligible compared to the protection. Always-on scrubbing filters continuously, so the route is consistent. You can test response times with and without scrubbing engaged to see if it matters for your workload.
How is scrubbing different from a null route?
A null route drops all traffic to your IP address, effectively taking you offline during an attack. Scrubbing discards only attack packets and forwards legitimate ones. If an attack overwhelms your scrubbing capacity, a null route is the fallback. Always-on mitigation includes edge scrubbing up to 12 Tbps, and you can configure null routing as a manual response.
Where Traffic scrubbing comes up
- What is included in every plan? Full root access, KVM virtualisation with custom kernel support, custom ISO upload, an out-of-band VNC console, one IPv4 address, a routed IPv6 /64, always…
- Are there setup fees or hidden charges? No setup fee, no provisioning charge, and no bandwidth overage billing. The plan price includes the transfer allowance, DDoS mitigation, one IPv4 address, …
- What makes OnionVPS different from other VPS providers? Four things: no identity verification of any kind, crypto-only payment with no card or bank involved, 138 locations in 116 countries including genuine offs…
More from security
- LUKS
- LUKS is the standard Linux full-disk encryption format, storing key material in a header on the encrypted volume itself.
- DDoS
- A DDoS attack floods a target with traffic or expensive requests from many sources at once, to exhaust bandwidth, connection state or processing capacity.
- Null route
- A null route discards all traffic to an IP address, protecting the wider network by making the target completely unreachable.
- fail2ban
- fail2ban monitors log files for repeated authentication failures and temporarily firewalls the offending addresses.