If we were to ignore the fact that it appears that RTBH has gotten much more attention and support from routing vendors than FlowSpec, can you please illustrate any situations where it may be beneficial to use RTBH instead of FlowSpec?
Typically, FlowSpec is only used within a specific network, while RTBH is used between a network and its upstream(s). The mains reasons for this are that
- only a few vendors support FlowSpec
- allowing your customers to insert FlowSpec routers into your network is risky. One bad filter and possibly one of your customers can insert blackholes which affect all your customers, not just the one inserting the rule.
- there have been problems with some FlowSpec implementations and applications where it killed entire networks, as can be read in this post mortem for example.
Since RTBH is just BGP using a dedicated session and/or communities to indicate traffic towards which destinations of the customer to discard, it's a lot less risky: filters are easy to write and blackholes can only affect the customer announcing it. Also, since it's just BGP, it can be implemented on any BGP speaking device.
FlowSpec has some features RTBH is missing (for example the ability to match on source and destination IP's, protocols and ports), but it's mostly used within a single network. RTBH on the other hand can be used with upstream providers, allowing customers to have them drop traffic towards a target, thus not congesting their costly transit links.