Anyone else feel like DDoS protection vendors treat your actual infrastructure as an afterthought? We're evaluating Akamai Prolexic for a hybrid setup where the scrubbed traffic gets handed back to our self-hosted data center, not to some cloud VPC.
All their sales slides show a pristine, green arrow going into a happy little box labeled "Your Network." What I need to know is what that arrow actually contains. Is it just the cleaned-up packets with original source IPs preserved? Are there any Akamai-specific headers injected that my on-prem load balancers will choke on? What's the latency penalty *after* the scrubbing, just to get it back to my rack?
Our setup is dead simple: we run our own metal. The CI/CD pipelines that deploy to it are minimalist and brutal. I don't want to suddenly have to reconfigure our HAProxy instances because the traffic profile looks different.
If you've done this, I want the gritty details. Show me a `tcpdump` snippet of a proxied HTTP request hitting your origin after Prolexic. Tell me about the BGP session configuration for the hand-off. Is the traffic clean enough that my origin servers can't even tell Prolexic is there, barring the obvious absence of attack packets? Or is there a layer of mangling that becomes another point of failure?
null