On this page
Key points
- Clean traffic is a design problem, not only a filtering problemA credible mitigation layer protects the link and then hands usable traffic back to the correct target through a consistent delivery model.
- The handoff defines operational realityLatency, MTU, routing and monitoring become central topics.
- Several models are credibleGRE, BGP over GRE, protected IPs, cross-connects or a router VM depending on the need.
Why clean traffic delivery matters as much as mitigation
If the cleaning layer stops the attack but hands clean traffic back poorly, the customer still ends up with a production problem. The real result is not “the attack was seen”; the real result is “the service stayed reachable and usable”.
Clean traffic delivery is what turns theoretical capacity into an operational result. It is the difference between a platform that looks impressive on slides and an architecture that survives in production.
- Business outcome
- Legitimate traffic has to get back to the service that consumes it.
- Network outcome
- The handoff must stay coherent with routing and existing constraints.
- Operational outcome
- The team has to understand what comes in, what goes out and how to monitor it.
The main clean traffic delivery models
There is no single universal model. Depending on the level of control required, clean traffic can be handed back through GRE, IPIP, VXLAN, BGP over GRE, cross-connects or a router VM that sits between mitigation and the customer environment.
The right choice mainly depends on public addressing, BGP ownership, deployment speed and how strongly you want to preserve the existing architecture.
Simple GRE
Fast to deploy and often enough to start in a clean way.
BGP over GRE
Adds more control when prefixes and routing decisions must remain on the customer side.
Protected IPs / cross-connect / router VM
Useful depending on how much simplification or control is expected.
Latency, MTU and asymmetric routing: what the handoff really changes
The delivery model directly impacts perceived latency, available MTU, asymmetric routing behaviour and troubleshooting simplicity. Technical buyers watch these topics very closely, especially for gaming, APIs or critical services.
A credible handoff model therefore has to be designed from the start around production constraints: where traffic returns, how it leaves again, what MTU stays comfortable and how to avoid surprises when the attack actually happens.
Why preserving the existing environment is often the best strategy
In many cases the customer does not want to reinvent the network. They want to add a clean Anti-DDoS layer in front of an existing dedicated server, cluster, business proxy or custom logic that already delivers value.
It lets you add protection without turning integration into a heavy migration project.
- Keep an existing server at OVH, Hetzner or another provider
- Keep XDP, DPDK or proxy logic already running in production
- Add a cleaning layer without moving the whole architecture
- Increase maturity progressively instead of replacing everything at once
Common mistakes
The first mistake is underestimating delivery and focusing only on scrubbing. The second is choosing a return model that is more complex than necessary when a simpler design would be more robust.
Another common mistake is ignoring MTU, monitoring and asymmetric return topics until the worst possible moment: the attack itself.
- Betting everything on mitigation
- Cleaning alone does not guarantee that service is truly restored.
- Choosing the most “premium” model by reflex
- The correct handoff is the one that fits the customer architecture.
- Ignoring network details
- MTU, return path, routing and monitoring are never minor details during an incident.
FAQ
Can clean traffic be sent back to my existing server?
Yes. In many cases that is exactly the point of the design.
Is simple GRE often enough?
Yes. For many deployments, simple GRE is already a very strong compromise.
When should BGP be added?
Mainly when you want to keep more control over your prefixes and routing decisions.
Does the handoff matter as much as the advertised mitigation capacity?
Yes. Without clean delivery, capacity alone does not create the expected production outcome.
Why is clean traffic delivery often the real weak point?
Because many projects think about scrubbing first and improvise delivery later. Poor clean handoff quickly breaks latency, sessions and operations.
