Understanding Modern DDoS Defense Architecture

1 DNS & Anycast

DNS is the first line of defense. Modern architectures use GeoDNS to return different IP addresses based on client location, and Anycast where multiple servers share the same IP address.

Query: www.example.com from US
Response: 104.16.1.1 (US PoP)

Query: www.example.com from EU  
Response: 104.16.2.1 (EU PoP)

2 Edge / CDN

CDNs operate a global network of Points of Presence (PoPs). Major CDNs have 100+ Tbps capacity, absorbing volumetric attacks through distributed scrubbing.

3 Scrubbing Centers

Scrubbing centers are dedicated traffic-cleaning facilities that sit between the internet and the origin infrastructure. During an attack, traffic is diverted through these centers via BGP route announcements, inspected for malicious patterns, and only clean traffic is forwarded to the origin.

How BGP-Based Diversion Works

When an attack is detected, the scrubbing provider advertises more-specific BGP routes for the target's IP prefixes. Internet routers prefer these more-specific routes, causing all traffic destined for the target to flow through the scrubbing center instead. After filtering, clean traffic is returned to the origin via GRE tunnels or direct peering.

Always-On vs On-Demand

• Always-on: All traffic permanently routes through the scrubbing center. Lower latency to detect attacks, but adds a constant hop and potential latency overhead.
• On-demand: BGP diversion activates only when an attack is detected. Reduces latency during normal operation, but introduces a switchover delay (typically 30-90 seconds) while BGP propagates.

Major Scrubbing Center Providers

How DDactic Detects Scrubbing Centers

DDactic identifies scrubbing center presence through multiple passive signals:

• BGP analysis: Monitoring route announcements for scrubbing provider ASNs in the path
• ASN ownership: Identifying IP ranges belonging to known scrubbing providers
• Latency patterns: Detecting the additional hop introduced by traffic diversion
• Response headers: Recognizing provider-specific headers injected during scrubbing

4 WAF / Application Firewall

WAFs protect against Layer 7 (application) attacks:

• Rate Limiting: Block IPs exceeding thresholds
• Bot Detection: Block automated/scripted requests
• Geo Blocking: Block traffic from specific countries
• IP Reputation: Block known-bad IPs
• Custom Rules: Block specific patterns/signatures

5 Load Balancer

Load balancers distribute traffic and provide health checks:

• Layer 4 (TCP/UDP): Fast, efficient, no application awareness
• Layer 7 (HTTP/HTTPS): Application-aware routing, can inspect headers

6 Origin Protection

The origin should ONLY accept connections from the CDN. This is the most critical and most often misconfigured layer.

# Nginx: Allow only CDN IPs
geo $allow_cdn {
    default 0;
    173.245.48.0/20 1;
    103.21.244.0/22 1;
    # ... other CDN ranges
}

server {
    if ($allow_cdn = 0) {
        return 403;
    }
}