Editing Denial-of-service attack (section)

===Upstream filtering===
All traffic destined to the victim is diverted to pass through a ''cleaning center'' or a ''scrubbing center'' via various methods such as: changing the victim IP address in the DNS system, tunneling methods (GRE/VRF, MPLS, SDN),<ref>{{cite web |url=https://archive.nanog.org/meetings/nanog23/presentations/afek.ppt |title=MPLS-Based Synchronous Traffic Shunt (NANOG28) |work=Riverhead Networks, Cisco, Colt Telecom |publisher=NANOG28 |date=2003-01-03 |archive-url=https://web.archive.org/web/20210515102444/https://archive.nanog.org/meetings/nanog23/presentations/afek.ppt |archive-date=2021-05-15 |access-date=2003-01-10 |url-status=dead }}</ref> proxies, digital cross connects, or even direct circuits. The cleaning center separates ''bad'' traffic (DDoS and also other common internet attacks) and only passes good legitimate traffic to the victim server.<ref>{{cite web |url=https://archive.nanog.org/meetings/nanog23/presentations/afek.ppt |title=Diversion and Sieving Techniques to Defeat DDoS attacks |work=Cisco, Riverhead Networks |publisher=NANOG23 |date=2001-10-23 |archive-url=https://web.archive.org/web/20210515102444/https://archive.nanog.org/meetings/nanog23/presentations/afek.ppt |archive-date=2021-05-15 |access-date=2001-10-30 |url-status=dead }}</ref> The victim needs central connectivity to the Internet to use this kind of service unless they happen to be located within the same facility as the cleaning center. DDoS attacks can overwhelm any type of hardware firewall, and passing malicious traffic through large and mature networks becomes more and more effective and economically sustainable against DDoS.<ref>{{cite web|url=https://research.sprintlabs.com/publications/uploads/RR04-ATL-013177.pdf |title=DDoS Mitigation via Regional Cleaning Centers (Jan 2004) |work=SprintLabs.com |publisher=Sprint ATL Research |archive-url=https://web.archive.org/web/20080921012859/http://research.sprintlabs.com/publications/uploads/RR04-ATL-013177.pdf |archive-date=2008-09-21 |access-date=2011-12-02 |url-status=dead}}</ref>