iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Server diversion is not one single event. In a planned DDoS defense, a provider reroutes traffic to a scrubbing center, removes malicious packets, and sends clean traffic back to the company. In an unauthorized incident, traffic may be redirected, copied, or mirrored to an unapproved destination. The second case can leave the visible network topology unchanged and therefore be difficult to spot.
Companies distinguish the two by establishing a normal traffic and routing baseline, collecting flow and log telemetry, checking route announcements against approved changes, and correlating anomalies with provider notifications and incident timelines. An unusual pattern is an investigation lead—not proof that a particular employee, provider, or attacker diverted traffic.
Two different meanings of server diversion
Planned DDoS traffic diversion
During a volumetric or application-layer DDoS attack, an organization can intentionally change the route for an IP prefix. Traffic first reaches a mitigation or scrubbing center, where filtering systems discard attack traffic. Legitimate requests then travel to the organization’s data center or origin servers. This is a documented availability control, not evidence of compromise.
Recommended Free Tools
The diversion may be activated manually after an attack is detected (on-demand) or may be in place continuously (always-on). The exact routing design, filtering capabilities, session behavior, and latency depend on the provider and the organization’s network.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Unauthorized redirection, copying, or mirroring
In an incident-response context, diversion can mean that traffic is sent to an unapproved system, copied to a compromised host, or mirrored for interception. RFC 4778, an informational Internet RFC published in January 2007, describes the risk this way: “There are also situations where mirrored traffic (often used for debugging, performance monitoring, or accounting purposes) is diverted to a compromised machine, which would not necessarily subvert any existing topology, and could be harder to detect.”
That observation matters because an attacker does not always need to change the obvious path between a user and a server. A switch mirror, tunnel endpoint, load-balancer rule, DNS or routing change, or compromised monitoring appliance can expose traffic while the normal topology diagram still appears correct.
What a company should baseline before looking for diversion
Detection is a comparison problem. Without a description of normal behavior, a spike or route change cannot be judged reliably. Build baselines for each important service, region, interface, and time period rather than relying on one network-wide average.
- Bandwidth: Record inbound and outbound volume by interface, prefix, protocol, and service. Keep normal peak periods, maintenance windows, and seasonal patterns.
- Device utilization: Track CPU, memory, packet rates, interface errors, connection tables, and load-balancer health. Cisco’s DDoS guidance specifically points to bandwidth and device CPU use as useful comparison telemetry.
- Traffic mix: Measure TCP, UDP, ICMP, and application protocols, along with source-country or autonomous-system distributions where that data is appropriate and lawful to retain.
- Application demand: Establish normal request rates, response codes, connection duration, authentication failures, and latency for each public application.
- Routing state: Keep an approved inventory of prefixes, origin autonomous systems, providers, diversion triggers, mitigation addresses, and the routes that should be visible during an activation.
- Operational changes: Synchronize network-change tickets, maintenance calendars, provider notifications, and DDoS runbooks with monitoring timestamps.
Baselines should be recalculated when architecture, capacity, providers, or user behavior changes. A fixed threshold that was useful last year can create false alarms after a major product launch or a new data-center connection.
Telemetry that can reveal an unexpected path
Network-flow records
Flow telemetry shows who communicated with whom and how. Cisco’s guide describes NetFlow records containing source IP address, destination IP address, source and destination ports, protocol, type-of-service (TOS) byte, and input interface. Retain enough data to compare the first anomalous interval with the approved route and destination.
Look for new destination addresses, a sudden change in the interface carrying a prefix, unexpected protocol or port concentrations, and traffic that continues to reach the origin when a diversion should have moved it elsewhere. Flow records generally summarize conversations; they do not replace packet capture when payload-level evidence is required.
Routing and control-plane data
Monitor BGP announcements, prefix origins, route withdrawals, next-hop changes, and the organization’s own edge-device configuration. An announcement that does not match the approved diversion plan deserves immediate review, especially if it changes the origin autonomous system or advertises a more-specific prefix.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
For a managed mitigation service, maintain the expected CIDR ranges and activation sequence. Alibaba Cloud’s setup guidance recommends checking route-asset databases, RPKI status, and whether announced CIDRs match the configured assets when traffic still reaches the data center after activation. Those checks are useful controls, but the exact commands and route behavior are specific to that service and should not be generalized to every provider.
Firewall, server, and application logs
Firewall and load-balancer logs can show a changed next hop, new NAT behavior, altered policy, or connections from an unexpected mitigation address. Origin-server logs can reveal whether clients are still reaching the origin directly, whether source addresses have changed as expected, and whether health checks are coming from an unfamiliar network.
Application logs add context: a request-rate spike, a new user-agent concentration, abnormal authentication failures, or a sudden increase in errors may indicate an attack or a routing failure. Preserve the original timestamps and time zone, and synchronize clocks with a reliable time source so network, provider, and application events can be compared accurately.
A practical detection workflow
- Define the approved design. Document every public prefix, origin location, normal next hop, mitigation endpoint, provider contact, activation trigger, and rollback condition. Record whether the service is on-demand or always-on.
- Collect the baseline. Store bandwidth, interface, CPU, traffic-mix, flow, request-rate, and latency data across ordinary peaks and quiet periods. Mark planned maintenance and known attacks so they are not mistaken for unexplained deviations.
- Centralize relevant records. Send flow data, BGP and router events, firewall and load-balancer logs, server logs, application metrics, and change records to systems with consistent timestamps and access controls. Set retention long enough to reconstruct an incident.
- Alert on combined anomalies. Trigger investigation when several signals move together—for example, an abrupt bandwidth increase plus edge CPU saturation, a new destination interface, or a request-rate change. Avoid treating one noisy metric as conclusive.
- Check the path and prefix. Compare the event’s timestamp, destination prefix, direction, next hop, origin, and interface with the approved diversion configuration. During an expected activation, verify that traffic follows the documented scrubber path and that origin traffic is the expected clean stream.
- Validate the provider event. Match the anomaly to a provider notice, ticket, activation record, or status event. If the provider reports diversion but routes or flow records do not reflect it, treat the mismatch as an operational problem requiring escalation.
- Investigate unauthorized changes. Review router and firewall configuration history, identity and access logs, switch mirror sessions, tunnel endpoints, DNS changes, load-balancer policies, and monitoring appliances. Look for changes made outside the approved window.
- Escalate and preserve evidence. Notify the network provider and incident-response team through the company’s runbook. Preserve flow exports, route views, configurations, logs, packet captures where available, and the timeline before changing routes or deleting suspicious settings.
- Assess service impact and recover carefully. Confirm whether users are receiving clean responses, whether the origin remains reachable as intended, and whether a rollback would expose the service to an ongoing attack. Make route changes under change control unless immediate containment is required by the incident plan.
Indicators that deserve investigation
- Traffic reaches the origin’s data-center interface after an on-demand diversion was confirmed.
- A public prefix appears through an origin autonomous system, next hop, or more-specific announcement that is absent from the approved design.
- Inbound volume, packet rate, or connection rate changes abruptly without a matching business event.
- Edge-device CPU, memory, connection tables, or interface errors rise while application demand is normal.
- Flow records show a new destination, mirror port, tunnel, or management interface receiving production traffic.
- Source-address patterns change in a way that conflicts with the documented scrubber behavior.
- Firewall, load-balancer, DNS, router, or switch configuration changes have no corresponding ticket or authorized operator.
- Monitoring, accounting, or debugging systems begin receiving copies of sensitive traffic they are not supposed to handle.
Each indicator has benign explanations. A provider may change a mitigation address, a software upgrade may alter source preservation, and a flash sale may create a legitimate request spike. Correlate several signals and check the change history before declaring diversion malicious.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11On-demand versus always-on DDoS diversion
The following comparison reflects Alibaba Cloud’s documented Anti-DDoS diversion model for its service, including guidance for IDC servers outside mainland China. Other providers may use different routing methods, activation times, capacity limits, or pricing.
| Characteristic | On-demand diversion | Always-on diversion |
|---|---|---|
| Normal traffic path | Traffic goes directly to the data center until activation. | Traffic passes through the scrubbing center continuously. |
| Response during an attack | An operator activates diversion after detection. | The path is already in place; no activation step is required during the attack. |
| Exposure and delay | Detection-to-activation time can leave a short exposure window. | There is no detection-to-activation delay, but traffic always uses the additional processing path. |
| Latency and path cost | Normal traffic avoids the scrubbing hop until activation. | The extra processing hop adds slight latency, according to the vendor documentation. |
| Typical fit in the cited documentation | Organizations facing attacks occasionally. | Organizations facing attacks frequently. |
Choosing a mode requires more than counting attacks. Consider the time needed to detect and activate, how much downtime a short exposure window could cause, whether source addresses and long-lived sessions must be preserved, the provider’s capacity in each region, and how operators will test and reverse the route. Ask for measured service-level commitments rather than assuming that “always-on” eliminates every failure mode.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to tell expected mitigation from suspicious diversion
Signs of an expected event
- A documented attack or threshold breach precedes the route change.
- The provider or internal network team records an activation with a timestamp and affected prefixes.
- Announcements, next hops, and destination interfaces match the approved mitigation configuration.
- Traffic volume and application health improve in a way consistent with filtering, while origin logs show the expected clean-source behavior.
- A planned rollback returns the route to its documented normal state and is recorded in the change system.
Signs of an unexpected event
- No approved change, incident, or provider notice explains the new route.
- A prefix is originated, more specifically advertised, or redirected to an unrecognized network.
- Traffic is copied to an unapproved mirror, tunnel, monitoring host, or compromised appliance.
- Configuration or identity logs show unauthorized access at the time of the path change.
- Users experience interception symptoms, certificate or session errors, unexplained latency, or data exposure while topology dashboards remain apparently normal.
These are investigative distinctions, not attribution rules. A suspicious route does not by itself identify the responsible person or organization. Establishing responsibility requires configuration evidence, provider records, access logs, and a defensible incident timeline.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Statistics and context without overinterpreting them
CERT-EU’s 2024 DDoS overview, attributing figures to Cloudflare’s Q1 2024 reporting, records 4.5 million mitigated DDoS attacks, 10.5 trillion HTTP DDoS requests, and 59 petabytes of DDoS traffic. One attack in that reported set reached 2 Tbps. These numbers describe Cloudflare’s Q1 2024 mitigation activity; they are not a current global count, a prevalence estimate for malicious server diversion, or a guarantee of what a particular company will experience.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →No universal threshold in the available guidance proves that diversion has occurred, and there is no named statistic here measuring how often malicious diversion happens or how effective one detection method is across all networks. Service, architecture, geography, provider, and time of day materially affect normal behavior.
Common mistakes and safer responses
Relying on topology diagrams alone
A diagram can omit mirror sessions, tunnel endpoints, policy-based routes, temporary prefixes, or compromised monitoring systems. Include control-plane data and configuration history in the investigation.
Using one threshold as proof
Bandwidth spikes can be legitimate, and route changes can be planned. Combine flow, device, application, and routing indicators, then validate against changes and provider events.
Changing routes before preserving evidence
Emergency containment may be necessary, but capture route views, flow records, configurations, and logs first when circumstances permit. Otherwise, the change can erase the evidence needed to explain the event.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Assuming all scrubbing services behave alike
Activation mechanisms, source-address handling, session support, route propagation, and latency differ. Test the exact provider configuration in a controlled exercise and document expected observations.
Ignoring the return path
Inbound traffic can be clean while outbound responses use an unintended route. Check both directions, NAT behavior, asymmetric paths, and origin reachability during and after activation.
What a durable runbook should contain
- A current prefix and asset inventory, including CIDRs, origin systems, autonomous systems, and approved mitigation routes.
- Named roles for network operations, security, application owners, provider contacts, and incident command.
- Dashboards for bandwidth, CPU, flow records, route state, request rates, latency, and origin health.
- Alert definitions with documented baselines and suppression rules for maintenance and known events.
- Provider activation, verification, rollback, and escalation procedures with out-of-band contact methods.
- Evidence-preservation instructions covering logs, configurations, route snapshots, flow exports, and packet captures.
- Regular exercises that test both an expected DDoS diversion and an unauthorized-route scenario.
The operational goal is not merely to notice that traffic moved. It is to demonstrate whether the movement matches an authorized mitigation, determine what users and systems were exposed, and restore the intended path without destroying the evidence needed for follow-up.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
