A clean pipe is a managed DDoS defensive service that routes all inbound traffic through a provider's scrubbing infrastructure and returns only filtered, legitimate traffic to the origin over a dedicated link. The term describes the delivery model: the customer receives a "clean" pipe of traffic with volumetric floods and known attack patterns already removed upstream, rather than operating its own scrubbing capacity.
Why it matters in DDoS testing
A clean-pipe arrangement shifts the defensive boundary to the provider edge, so the questions a test must answer move with it: does diversion engage fast enough, does the scrubbing capacity exceed plausible attack volume, and can the origin still be reached directly, bypassing the pipe entirely. Capacity and detection-latency characteristics vary by provider, a comparison drawn out in the AWS Shield and Cloudflare comparison.