After scrubbing, how does cleaned traffic reach your origin, and what does that return path break?

## The half nobody costs Every description of scrubbing stops at 'and then clean traffic is delivered to you'. That delivery is a real circuit with real limits, and in practice it is where diversion architectures fail. There are two common forms: - **A tunnel over the public internet** from the scrubbing centre to your edge router — generic encapsulation, or an encrypted tunnel. Cheap, flexible, deployable anywhere. - **A dedicated circuit or cross-connect** — a private link between the provider's infrastructure and yours, usually only possible where you share a facility or buy transport. Predictable and clean, and considerably more expensive. ## Failure one: the return path is the new bottleneck Diversion does not deliver an unbounded stream of clean traffic. It delivers as much as the return path carries. Two traps: - People size the tunnel to *average* legitimate load. During an attack, legitimate load is frequently **above** average — customers retrying, monitoring escalating, load balancers re-establishing. You have replaced a saturated uplink with a saturated tunnel and the outcome for the customer is identical. - Scrubbing is never perfect. Whatever the provider passes as legitimate but is not still consumes return-path capacity, and a filter tuned conservatively to avoid dropping real users passes more of it. The honest sizing question is not 'what do we normally receive' but 'what does legitimate traffic look like on the worst day, plus whatever leaks through the filter'. ## Failure two: the packet gets smaller Encapsulation prepends headers. A generic-routing-encapsulation return path costs 24 bytes — a 20-byte outer IPv4 header plus a 4-byte encapsulation header — so on an ordinary 1500-byte path only 1476 bytes of the original packet fit. This produces one of the most confusing symptoms in networking: small requests work perfectly, large responses or uploads hang. The sender emits a full-size packet with the do-not-fragment bit set; it does not fit; the router should signal the sender to send smaller packets, but that signalling message is very often filtered somewhere along the path, so the sender simply retries the same too-large packet forever. The connection establishes and then stalls. The standard mitigation is clamping the maximum segment size on the tunnel so endpoints negotiate a packet size that fits from the start, rather than relying on discovery. Anyone who has run a tunnelled return path has had this outage; describing the symptom is a strong credibility signal. ## Failure three: the flow becomes asymmetric With diversion active, inbound traffic arrives via the provider and the return path. **Replies leave by your ordinary transit**, because your default route did not change. Consequences: - **The scrubbing provider sees one direction only.** Any judgment they make that depends on both sides of a conversation is degraded; they see requests and never the responses. - **Your own stateful devices can break.** A firewall in the reply path sees outbound packets for connections whose inbound half arrived on a different interface, or arrived at a different device entirely. Depending on the design, it drops them as having no matching state. Anti-spoofing checks that verify a source address against the expected inbound interface can also drop the diverted traffic outright. - **Diagnosis gets harder.** Captures taken at one point show half the conversation. These are design constraints to settle before the first diversion, not surprises to meet during one. ## Failure four: the return path is itself a target The tunnel terminates on an address of yours that is reachable and, with reconnaissance, findable. An adversary who identifies it can flood the tunnel endpoint directly. The front door is beautifully clean and the back door is on fire — you are paying for scrubbing while the delivery road is blocked. Mitigations include keeping the endpoint in a different prefix from the protected service, ensuring the endpoint's own prefix is covered by the mitigation contract, or using a private circuit that has no public address at all. ## And it is a second bill The scrubbing contract is one line item; the transport that carries cleaned traffic home is another. A private cross-connect can rival the mitigation fee itself, and a tunnel over transit consumes bandwidth you are already paying for at exactly the moment your bandwidth commit matters. When the finance conversation happens, the return path must be in the number, or the number is wrong. ## What to say in an interview Name the four failures — capacity ceiling, packet size, asymmetry, and the endpoint being a target — and then name the tests. Verify during a rehearsal that a full-size packet completes end to end, that the tunnel carries peak-day legitimate volume, and that your stateful devices tolerate flows arriving from one direction and leaving by another. Every one of those is discovered the hard way otherwise, at the worst possible moment.