Traffic diversion is the rerouting of network traffic away from its intended destination. In normal operations, devices such as routers, load balancers, and DNS systems guide packets to the correct service. In an attack, the path can be altered so that users, updates, or API calls are sent somewhere else first, often without the victim noticing immediately.
This matters because security controls often assume the delivery path is trustworthy. If traffic is diverted, attackers may intercept credentials, serve malicious content, or disrupt updates and logging. A common example is BGP hijacking, where false routing announcements pull internet traffic toward the wrong network. Defenders watch for route anomalies, sudden endpoint changes, certificate mismatches, and unexpected latency or packet loss. Traffic diversion does not always mean compromise of the destination system, but it can undermine the integrity of everything delivered over that path.