Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteServer diversion can mean two very different things. In a planned DDoS defense, a provider reroutes traffic through a scrubbing center so attack traffic is filtered before legitimate requests return to the company. In an unauthorized incident, traffic may be redirected, copied or mirrored to a system that should not receive it. Companies distinguish the two by comparing routing, flow records, device and application telemetry, provider notifications and change records against an approved baseline.
Server diversion has two security meanings
The phrase is not a single technical condition. Its meaning depends on who changed the traffic path and why.
As an Amazon Associate I earn from qualifying purchases.
Planned DDoS diversion
A DDoS mitigation service can intentionally change how packets reach a protected service. During an attack, the organization or provider advertises a route, changes DNS or uses another agreed mechanism to send traffic to a scrubbing center. The scrubbing network absorbs or filters malicious traffic and forwards the traffic judged legitimate to the data center or cloud origin.
This is a documented defensive operation, not evidence of compromise. The approved route, prefixes, activation procedure, provider contact and rollback steps should exist in the company’s DDoS runbook. A route change that matches those records and a provider’s incident notice is normally expected diversion.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Unauthorized redirection or copying
An attacker, compromised device or misconfigured intermediary can also redirect traffic, mirror packets or copy selected flows to an unauthorized destination. Such activity may leave the visible network topology unchanged. RFC 4778, an informational Internet RFC published in January 2007, discusses cases in which mirrored traffic used for debugging, monitoring or accounting is diverted to a compromised machine; because the topology need not change, this type of diversion can be difficult to spot.
That second meaning is the focus when a security team asks whether a server has been diverted. An unexpected destination, route announcement, mirror session, proxy, firewall rule or traffic pattern is a lead for investigation. It is not, by itself, proof that a particular employee, provider or attacker caused the change.
How a planned DDoS diversion works
The precise mechanism varies by provider and architecture, but the operational sequence is usually:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Detection: monitoring identifies traffic volume, packet rate, protocol mix or application requests that threaten availability.
- Activation: an operator, automation rule or provider changes the approved route or other traffic-steering control.
- Scrubbing: the mitigation network classifies and drops attack traffic while forwarding traffic that meets its filtering policy.
- Return to origin: cleaned traffic is delivered to the company’s data center or cloud service, often through a tunnel or provider interconnect.
- Deactivation: after the event, the organization withdraws the diversion and confirms that normal routing has resumed.
Alibaba Cloud’s documentation describes two broad operating modes for its Anti-DDoS diversion service. The details below apply to that documented service, including its stated scope for IDC servers outside mainland China; they are not universal guarantees for every mitigation provider.
| Characteristic | On-demand diversion | Always-on diversion |
|---|---|---|
| Normal traffic path | Directly to the data center until activation | Continuously through the scrubbing center |
| Response during an attack | An operator activates diversion after detection | No activation step is needed when an attack starts |
| Exposure and latency | Detection-to-activation time can leave a short exposure window | A processing hop is always present and adds slight latency |
| Fit identified in the documentation | Organizations facing attacks occasionally | Organizations facing attacks frequently |
Before choosing a mode, measure the business cost of a short activation delay against the cost of continuously adding a provider hop. Confirm the provider’s actual detection, session, routing and latency behavior for your region and architecture rather than assuming that another service works identically.
Build a baseline before looking for diversion
There is no universal bandwidth or request-rate threshold that proves diversion. A normal profile differs by application, region, network design, provider and time of day. Cisco’s DDoS guidance recommends comparing current telemetry with normal behavior, including bandwidth, device CPU utilization and traffic type. Establish those reference values before an incident.
Baseline the network
- Inbound and outbound bits per second and packets per second for each internet-facing prefix.
- Traffic by protocol, source and destination port, interface, direction and geography where that data is available.
- Router, firewall, load-balancer and host CPU, memory, interface errors and connection-table use.
- Normal next hops, autonomous-system paths and the approved origin of each advertised prefix.
Baseline the applications
- Requests per second, response codes, latency and connection failures by service.
- Normal ratios of authenticated to anonymous requests and normal API, web, DNS or mail traffic mix.
- Expected maintenance windows, deployment events, failovers and traffic from known partners.
Record the time zone and observation window used for each baseline. A weekday peak, a product launch and a quiet overnight period should not be treated as the same normal state.
Collect telemetry that can reveal an unexpected path
Flow data shows who communicated, how and through which interface; logs show what the control plane and applications believed happened. Retain enough history to compare an alert with earlier behavior and with the company’s change records.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
| Telemetry | Useful fields or questions | What it can reveal |
|---|---|---|
| Network-flow records | Source and destination IP addresses, source and destination ports, protocol, type-of-service byte, input interface, bytes, packets and timestamps | A new destination, unusual volume, protocol shift or interface path |
| Routing data | Prefix announcements, origin and path, next hop, withdrawal time, RPKI validation state and matching CIDR | Whether traffic steering matches the approved diversion configuration |
| Router and firewall logs | Configuration changes, access-list edits, NAT or policy changes, mirror or tunnel events, administrator identity and time | Unauthorized control-plane or forwarding changes |
| Server and load-balancer logs | Source address as seen at each tier, listener, health checks, connection counts, errors and backend selection | Unexpected ingress points, proxy behavior or a break in the normal forwarding chain |
| Application logs | Request rate, paths, status codes, authentication events, user-agent or API-key patterns and latency | An attack pattern or a diversion that changes what the application receives |
| Provider and change records | Activation ticket, incident notice, maintenance window, route asset and rollback confirmation | Whether a path change was authorized and expected |
Cisco’s example NetFlow fields include source IP, destination IP, source and destination ports, protocol, type-of-service byte and input interface. The exact fields depend on the exporter and collector, so document any gaps rather than treating an incomplete record as proof that traffic was not diverted.
A practical detection workflow
1. Alert on a material deviation
Use alerts for abrupt or unexplained changes in bandwidth, packet rate, device utilization, traffic mix, request rate, route state or application errors. Set thresholds from your baseline and use separate thresholds for different services. An alert should include the affected prefix or hostname, direction, first-seen time and comparison period.
2. Confirm the destination and direction
Use flow records to determine whether the unusual traffic is inbound, outbound or east-west. Identify the destination address, port, protocol and interface. A spike directed at a known scrubbing endpoint during an approved activation is different from a new outbound stream to an unrecognized host.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Compare the path with approved changes
Check router and provider telemetry at the alert’s timestamp. Compare the announced prefix, origin, next hop, tunnel state and CIDR with the DDoS runbook and the provider’s activation record. Alibaba’s setup guidance specifically advises checking route asset databases, RPKI and matching CIDR announcements when traffic continues to reach the IDC after diversion is activated.
4. Check control-plane and mirror configuration
Review recent changes to BGP sessions, route maps, static routes, NAT, firewall rules, packet brokers, SPAN or mirror sessions, tunnels, proxies and load-balancer listeners. Verify the administrator, ticket number, approval and exact before-and-after values. A valid user account used outside its normal window deserves the same scrutiny as an unknown account.
5. Correlate network and application evidence
Determine whether the application saw the same sources and volume as the network exporter. A proxy or scrubbing layer can change source-address visibility, so check the documented forwarding headers and logs at each tier. Correlate request-rate spikes, status-code changes, authentication failures and latency with the route event rather than relying on one dashboard.
6. Validate with the provider and change owner
Contact the designated mitigation or transit provider through a known channel and ask for the activation time, affected prefixes, filtering status and current path. Ask the internal change owner to confirm the ticket and rollback plan. Do not accept an unexpected route change solely because a provider name appears in a log.
7. Preserve evidence and escalate
Export flow records, routing snapshots, configuration diffs, firewall and server logs, provider messages and a synchronized incident timeline. Escalate according to the company’s incident-response runbook. Avoid withdrawing or adding routes during an investigation unless the network and incident leads approve the action and understand the availability risk.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
How to distinguish expected diversion from suspicious diversion
| Observation | More consistent with planned mitigation | More suspicious |
|---|---|---|
| Route change | Matches the approved prefix, provider, time and activation ticket | Unapproved origin, unexpected next hop or a prefix outside the documented scope |
| Traffic destination | Known scrubbing address or tunnel endpoint | Unknown host, unusual country or an internal system that should not collect mirrored traffic |
| Application behavior | Source-address and header changes match the documented proxy path | New forwarding headers, missing logs or traffic bypassing the expected inspection tier |
| Control-plane event | Change made by the designated operator during an incident | Unexplained account, out-of-hours edit or a configuration change without a ticket |
| After the event | Routes return through the documented rollback process | Residual tunnel, mirror session, route or policy remains active |
These indicators support triage; none attributes responsibility on its own. Attribution requires corroborating identity, access, provider and timeline evidence.
Operational trade-offs when selecting a diversion mode
On-demand
On-demand routing keeps ordinary traffic on the direct path and limits the added processing hop to an attack. Its weakness is the interval between detection and activation. That interval can be significant for a service that saturates quickly, especially if activation requires a human, a provider ticket or a route-propagation step. Test the runbook, contact paths and rollback in advance.
Always-on
Always-on routing removes the activation step during an attack and gives the provider continuous visibility for filtering. The trade-off is that normal traffic permanently traverses the scrubbing center, which the cited Alibaba documentation says adds a processing hop and slight latency. Confirm capacity, data handling, regional path, failure behavior and service-level commitments with the chosen provider.
Neither mode removes the need for monitoring. Always-on service can still be misconfigured, bypassed or compromised, while on-demand service can be activated for the wrong prefix. In both cases, maintain independent route, flow and application telemetry.
Common detection mistakes
- Treating volume as proof: high bandwidth can be a legitimate release, backup or customer event. Pair it with path, destination and change evidence.
- Watching only topology: mirrored traffic can be copied to a compromised host without an obvious topology change, as the RFC 4778 example illustrates.
- Ignoring outbound traffic: diversion or capture can create an unexpected egress stream even when inbound availability looks normal.
- Using one log source: flow exporters, routers, applications and providers observe different layers. Correlation reduces false conclusions.
- Failing to validate prefixes: a route can appear to change while the wrong CIDR, origin or RPKI state is being advertised.
- Changing routes before preserving evidence: emergency action may be necessary, but record the original state first when circumstances permit.
- Assuming vendor behavior is universal: timing, session controls and latency described for one service do not establish the same behavior elsewhere.
What the recent DDoS figures do—and do not—show
CERT-EU’s 2024 DDoS overview, attributing figures to Cloudflare, reported that 4.5 million DDoS attacks were mitigated in the first quarter of 2024. The same report cited 10.5 trillion HTTP DDoS requests and 59 petabytes of DDoS traffic in that quarter, with one reported attack reaching 2 Tbps.
Those figures describe Cloudflare’s Q1 2024 mitigation activity, not current global activity and not the prevalence of malicious server diversion. They provide scale for why organizations plan traffic diversion; they do not supply a universal detection threshold or show that a particular route change is hostile.
A concise runbook for the next alert
- Identify the affected service, prefix, direction and first-seen time.
- Capture flow, route, firewall, server and application evidence before making discretionary changes.
- Check the approved DDoS configuration, provider notice, change ticket, route asset database, RPKI state and CIDR match.
- Inspect mirror sessions, tunnels, NAT, proxies and administrator activity for unauthorized changes.
- Ask the provider and internal change owner to confirm the path through known contacts.
- Assess availability and data-exposure risk, then follow the incident-response and rollback procedures.
- Document the timeline and update baselines, alerts and runbooks after containment.
The decisive question is not simply whether traffic moved. It is whether the movement matches an authorized purpose, approved path and recorded time. Baselines, multi-source telemetry and disciplined route validation let a company answer that question without mistaking normal DDoS protection for an intrusion.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
