Incoming traffic first goes through the DDoS-Guard scrubbing network to filter out malicious requests. Attacking packets and requests are dropped so that the WAF is only used to process clean traffic. This helps to avoid wasting resources on processing garbage requests.