¿Worried about DDoS taking down bare-metal or dedicated infrastructure? Many organizations assume cloud providers or on-box firewalls are enough. This guide focuses exclusively on Bare-metal y servidores dedicados con scrubbing DDoS and delivers architecture, measurable benchmarks, step-by-step integration, and incident playbooks so decisions are immediate and actionable.
Key takeaways: what to know in 1 minute ✅
- ✅ Scrubbing is essential for high-bandwidth attacks: For volumetric DDoS above a few Gbps, network-level scrubbing at the edge prevents saturated links to bare-metal and dedicated servers.
- ✅ Two main deployment models: Managed scrubbing centers (on-net) vs on-premise / customer on-ramp with RTBH/BGP, each with trade-offs in latency, cost, and control.
- ✅ Measure before you buy: Request real metrics: per-POP capacity, peak mitigation throughput, typical mitigation latency, and logged case studies with timestamps.
- ✅ Integration requires BGP or inline on-ramps: Implement BGP flowspec/RTBH for fast rerouting or use dedicated on-ramps (GRE/VXLAN) to scrubbing centers.
- ✅ Operational playbook matters more than headline Tbps: SLAs, per-client caps, false-positive rollback, and post-mitigation forensics determine business impact.
Bare-metal and dedicated servers typically sit on fixed bandwidth links and lack the elastic bursting available in large clouds. Scrubbing removes malicious traffic upstream or at a neutral on-ramp and returns only legitimate flows, protecting the server's link and CPU resources.
- 💡 What scrubbing does: removes spoofed traffic, malformed packets, and volumetric UDP/ICMP floods before they reach the server.
- ⚖️ Where it operates: at edge POPs, scrubbing centers, or via inline appliances connected with deterministic routing.
- 🛠️ Why it matters for bare-metal: dedicated single-tenant performance is destroyed by link saturation; scrubbing keeps latency and throughput within SLA.
Scrubbing center (cloud/managed) model
A provider accepts traffic via public IP advertisement or GRE/VXLAN tunnels, routes suspect flows to the scrubbing cluster, and forwards cleaned traffic back to the origin.
- Advantages: large aggregate capacity, global POP distribution, managed operations.
- Drawbacks: potential extra latency, per-customer capacity caps, complex routing changes.
On-ramp / private link model
Customer provisions a VLAN or private connection to a scrubbing on-ramp (MPLS, Direct Connect, or dedicated fiber). Traffic is forwarded to scrubbing infrastructure and returned over the same private link.
- Advantages: predictable latency, better control over routing, simpler failover.
- Drawbacks: higher setup cost, provisioning lead time.
Inline appliance / edge scrubbing at colo
Physical scrubbing appliances or virtualized scrubbing at the same colo as bare-metal servers intercept traffic inline.
- Advantages: minimal hops, direct packet handling.
- Drawbacks: capacity limited to appliance specs; less elastic.
Technical integration steps: BGP, RTBH, and on-ramps 🛠️
Step 1: baseline network inventory and link profiling 📋
- Map physical links, port speeds, and peering relationships.
- Record baseline metrics: average bandwidth, 95th percentile, typical latency to core POPs.
- Identify all public prefixes and routing origin ASNs.
Step 2: choose a mitigation onboarding method 💡
- BGP advertising (blackholing + traffic steering), fast, common.
- BGP Flowspec, granular but requires supported routers and testing.
- GRE/VXLAN tunneling to scrubbing POP, secure and consistent for on-ramps.
- Physical cross-connect to scrubbing fabric, lowest latency but involves colo provisioning.
Step 3: implement routing and automation 🔁
- Configure BGP sessions with the scrubbing provider and set route-maps for controlled prefix announcements.
- Build IaC to toggle mitigation actions (Terraform + router templates) and webhook integrations with monitoring.
- Ensure automated rollback criteria to avoid prolonged collateral damage.
Step 4: logging, forensics and compliance 🧾
- Collect pcap-level samples or NetFlow/IPFIX metrics from scrubbing outputs for post-incident analysis.
- Ensure log retention meets compliance (HIPAA, PCI, or regional laws) and that chains of custody exist for evidence.
- Trade-off: deep scrubbing (stateful inspection) increases processing time; bulk volumetric scrubbing is faster.
- Latency budget: measure RTT through scrubbing path; aim for <20–50 ms additional latency for web services; <5–10 ms for high-frequency trading is challenging.
- Throughput consistency: verify provider's 95th percentile mitigation throughput per-POP and per-customer caps.
- Ask for real case logs with timestamps and mitigation throughput.
- Request colocated test IPs to run synthetic latency and throughput tests.
- Verify scrubbing does not drop TLS handshakes or fragment legitimate traffic.
| Feature |
Managed scrubbing (cloud) |
On-ramp private link |
Inline appliance (colo) |
| Typical latency added |
10–60 ms |
5–30 ms |
1–10 ms |
| Setup time |
1–7 days |
2–30 days |
1–14 days |
| Scalability |
High (Tbps) |
Medium-High |
Limited by hardware |
| Cost model |
OPEX, per-mitigation |
Setup + OPEX |
CAPEX + ops |
| Control & visibility |
Provider-managed |
Shared control |
Full control |
| Compliance friendliness |
Varies |
Good (private links) |
Best (local capture) |
Cost and TCO considerations 💰
- Managed scrubbing: lower upfront costs, pay-per-attack or monthly subscription; unpredictable OPEX during frequent attacks.
- On-ramp private links: higher setup CAPEX, predictable monthly circuits; lower incremental cost per mitigation.
- Inline appliances: highest CAPEX, requires onsite expertise; predictable but requires lifecycle planning.
Estimate total cost by combining: circuit fees, scrubbing subscription, engineer hours, and potential revenue loss per minute of downtime. Use a cost-per-Mbps mitigated and expected attack frequency to model TCO.
Example practical: how scrubbing works in a real incident 📈
📊 Case data:
- Origin: Dedicated bare-metal server, /24 announced from ASN 64501
- Link: 10 Gbps public transit
- Observed attack: UDP amplification peaking at 120 Gbps
- Provider: Managed scrubbing with multi-POP capacity
🧮 Process:
- Detection: monitoring triggers threshold at 80% link utilization.
- Action: BGP community triggers diversion to nearest POP; traffic tunneled to scrubbing cluster.
- Mitigation: scrubbing removes amplified UDP flows, permits established TCP flows, rate-limits suspicious protocols.
✅ Result:
- Link utilization reduced to 12% within 90 seconds.
- Application latency rose by 18 ms (acceptable for web), uptime maintained.
This sample uses realistic timing: detection to mitigation in under 2 minutes is achievable with automated BGP flows and pre-established peering.
Textual process flow: scrubbing lifecycle ▶️
🟦 Detect → 🟧 Divert → 🟩 Scrub → ✅ Return & validate
- Detect: threshold-based or anomaly-based detection by NOC/monitoring.
- Divert: route suspect traffic to scrubbing POP via BGP or tunnel.
- Scrub: apply signatures, heuristics, and behavioral filters.
- Return & validate: forward cleaned traffic back; validate session integrity.
Interactive simulation box: calculate required scrubbing capacity 🧮
📊 Data case:
- Average inbound peak baseline: 4 Gbps
- Expected attack amplification factor: 25x (common for DNS/CLDAP)
- Multipliers for safety: 1.5x headroom
🧮 Calculation/Process:
- Expected peak attack = 4 Gbps * 25 = 100 Gbps
- Required mitigation capacity = 100 Gbps * 1.5 = 150 Gbps
✅ Result: 150 Gbps scrubbing capacity recommended for this origin. Choose a provider with >=150 Gbps per-POP or distributed capacity with guaranteed per-client throughput.
Infusion of evidence: metrics and testing guidance 📐
- Run synthetic tests: iPerf over the scrubbing path and HTTP/HTTPS transaction profiles.
- Collect before/after metrics: RTT, TCP handshakes per second, TLS handshake success rate, error rates, CPU load on the bare-metal host.
- Request provider logs: timestamps, mitigation rule IDs, per-flow packet drops, sample pcaps (redacted) for forensic validation.
Real-world providers often publish Tbps numbers; insist on per-customer caps and per-POP commitments rather than aggregated peak capacity alone.
Advantages, risks and common mistakes ✅⚠️
Advantages / when to apply ✅
- Protect public-facing bare-metal servers hosting critical infrastructure or customer portals.
- When link saturation causes revenue loss or regulatory impact.
- For organizations needing forensic logs retained and chain-of-custody for legal actions.
Errors to avoid / risks ⚠️
- Relying solely on headline Tbps without asking about per-client caps.
- Deploying scrubbing without rollback automation leading to long outages from false positives.
- Ignoring latency-sensitive applications: some scrubbing introduces unacceptable jitter.
- Failing to test BGP Failover and route withdraw sequences; routing flaps can cause longer outages.
Integration with firewalls, WAF and orchestration 🧩
- Align scrubbing with WAF policies to avoid redundant filtering and false positives.
- Ensure orchestration scripts update firewall rules and access lists after mitigation to re-open legitimate flows.
- Use IaC (Terraform, Ansible) to manage BGP templates and remediation playbooks so mitigation actions are repeatable and auditable.
Playbook excerpt: incident steps (short) 📋
- Alert: threshold breach recorded and verified.
- Divert: announce prefix to scrubbing provider or activate tunnel.
- Monitor: confirm cleaned stream; check TLS success and session counts.
- Forensics: capture NetFlow samples and pcap snippets.
- Rollback: withdraw diversion after stable 30–60 minutes.
- Post-incident: review logs, tune filters, update SLAs with provider.
Compliance, forensics and logs 🧾
- Ensure scrubbing provider supports secure log delivery (SFTP or SIEM integration) and agreed retention windows.
- For legal evidence, confirm timestamps are synchronized (NTP) and logs include hashes for integrity.
- Verify privacy policies for packet capture and the retention of payloads; redact sensitive data if needed.
Vendor selection checklist: must-have questions 🎯
- What is the per-customer throughput cap at each POP? Request numeric values.
- What is the typical mitigation time from detection to scrubbing (in seconds)?
- Are mitigation rules reversible automatically? What safeguards exist against extended false positives?
- Is there an RPO/RTO commitment for mitigation and post-mitigation traffic restoration?
- Can the provider deliver pcap samples / NetFlow logs for forensic analysis?
- What compliance certifications (SOC2, ISO27001) does the provider hold?
Infographics: comparison and timeline, visual authority
Comparative: managed scrubbing vs on-ramp vs inline
Managed
👍 Scalability
⚡ Latency medium
💵 OPEX
On-ramp
🔒 Private link
⚖️ Predictable latency
🔧 Setup cost
Inline
🏢 On-site control
📉 Limited scale
🧾 Forensics best
Mitigation timeline
⏱
0–30s: Detect and validate anomaly. Monitoring flags high utilization.
30–120s: Divert traffic via BGP or tunnel to scrubbing POP.
120–300s: Scrub and forward cleaned traffic. Monitor latency and TLS integrity.
5–60 mins: Stabilize, collect forensics, plan rollback.
Testing and benchmarking protocol 📏
- Run controlled floods on a test prefix (with provider consent) to measure end-to-end mitigation time and packet loss.
- Use a mix of TCP, UDP, and fragmented packet tests to validate filter behavior.
- Record: detection time, diversion time, mitigation time, percent packet-loss reduction, added latency, and CPU load on the origin host.
Vendor SLA terms to insist on and red flags ⚠️
- Require per-customer throughput guarantees and clear limits on how mitigation is prioritized during global peaks.
- Insist on RTO for rollback and measured mitigation time windows.
- Red flags: vague Tbps numbers without per-client data, no forensic logs, or refusal to perform live tests.
What is the difference between scrubbing and a firewall?
Scrubbing operates at network scale to remove volumetric and protocol-based attacks before they saturate links; firewalls filter connections at the host or edge but cannot absorb very large volumetric attacks alone.
Can scrubbing affect legitimate traffic or TLS sessions?
Yes, aggressive heuristics can impact legitimate flows. Reputable providers validate TLS handshakes and provide rollback criteria to minimize false positives.
How fast can scrubbing start after detection?
With pre-established BGP or on-ramp, diversion and mitigation commonly begin in under 2 minutes; full stabilization varies by attack complexity.
Is scrubbing compatible with PCI, HIPAA or other compliance?
Scrubbing can be compatible if the provider supports required logging, data handling policies, and agreed retention. Verify certifications like SOC2 and ISO27001.
Choose based on latency sensitivity, budget, and compliance. Low-latency apps may prefer on-ramps; highly elastic needs favor managed scrubbing.
How to size scrubbing capacity for a dedicated server?
Profile normal peak inbound bandwidth, multiply by observed amplification factors for expected attack vectors, add a safety headroom (1.3–1.5x) and select provider capacity accordingly.
Can scrubbing providers mitigate application-layer attacks?
Many do (Layer 7 WAF and behavioral filtering), but for bare-metal, verify that application-layer mitigation won't disrupt specific protocols and that the provider supports custom rule sets.
What logs should be requested after an incident?
NetFlow/IPFIX exports, mitigation rule IDs and timestamps, sample pcaps (redacted), and a mitigation timeline showing when rules were applied and withdrawn.
Conclusion: operational next steps and priorities
- Contact two scrubbing providers and request per-POP per-customer throughput commitments, mitigation timelines, and live test offers.
- Prepare network automation: BGP session templates and IaC to enable scripted diversion and rollback.
- Run a tabletop incident with the NOC and scrubbing provider, reviewing the forensic log handoff and escalation matrix.
The reader should now have a clear blueprint to evaluate and implement Bare-metal y servidores dedicados con scrubbing DDoS. Prioritize measurable SLAs, realistic latency tests, and automated rollback to reduce business risk.
