BGP null route when DDoS?

Question

I need suggestion related this issue. We are getting DDoS every two days and its small DDoS last for 5 to 10 min. but sometime its longer in that case we call ISP and they null route specific targeted IP for sometime and we moved service to new IP.

Now question is, is it possible we setup private BGP with our ISP and we do null route from our router so it trigger blackhole null route on ISP route? In short we need control of doing null routing, calling every time ISP isn't good solution because sometime they are busy then we have to wait in line.

Can anyone suggest what we should do? We are small company and can't effort buying outside service to scrub DDoS they are expensive.

Answer 1

The only answer we can give you is 'talk to your ISP'. Remotely triggered blackholing (RTBH) is an often used technique, but we can't tell if your ISP supports this.

When using RTBH, you can announce to your upstream which target IP's should be blackholed, either over a dedicated BGP sessions or by tagging target prefixes with a specific community.