This question is for general information about BGP flowspec, Can i implement BGP flowspec to stop DDoS? RTBH isn't what we want because it blackholing all traffic, we want RTBH at Layer 4 level where we can tell BGP to blackhole destination port 500.

  • Big question is do i need support from my ISP or peer ISP?
  • Do i need special equipment to implement?
  • Or this service is something only ISP can do and we can use as a customer?

I did google and found all short of answer but still there are some basic question i have in my mind which i thought i will get answer here.


  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 9:22

Big question is do i need support from my ISP or peer ISP?

Typically, you would use bgpflowspec only within your own network. I'm aware of only one major ISP which is willing to do flowspec with their downstream customers, I have never seen any network which is willing to accept bgpflowspec from their peers.

It's very hard to proper filtering on bgpflowspec between networks, since the filter you set on your network (possibly globally) should only be applied in the upstream networks specifically for your network. Your 'drop all Memcached traffic' bgpflowspec rule should only apply to your IP addresses, not on all traffic carried by your peers or upstreams. The risks of your bgpflowspec rule messing up another network is usually too big to make it a proper solution.

Badly configured bgpflowspec rules can really mess up your own network as well. A long time ago I improved the spamfiltering capabilities of our network drastically by emptying a prefixlist which was used to apply a SMTP filter for spammers. That day I learned the hard way that on Juniper an empty IP prefixlist on a bpgflowspec rule is equal to "match any IP address".

Do i need special equipment to implement?

You need routers which support it. You only tagged this question with Cisco, but of course only specific Cisco models support this. In addition, you can use bgp clients like Exabgp to inject bgpflowspec routes.

Or this service is something only ISP can do and we can use as a customer?

You're not really specific in what kind of network you are operating, what devices and topology you use and and how you're connected to your upstream ISP(s?). At least you need to be running BGP within your network, if not, there's no point in running bgpflowspec. In addition, at least some of the devices need to support bgpflowspec, and these devices should be placed close to all borders of your network, so you can actually block the traffic.

  • Thank you for very detailed answers of my question, we use eBGP with our ISP and we have all Cisco Nexus 9000 switches L3/L2, recently we are getting lots of DDoS, our internet pipe is 80Gbps but we are getting 100Gbps DDoS sometime. Third-party solution looking very price from business point. So trying to find a other way around to reduce. Do you think ipv6 will help to reduce attack?
    – Satish
    Sep 5 '18 at 22:58
  • If saturation of your uplinks is your problem, your best (and almost only) strategy is to make sure the DDoS traffic does not reach your network. Bgpflowspec only works in this case if you can announce those filters to your upstream ISP. I wrote a more detailed answer on DDoS mitigation strategies on another SE site some time ago: security.stackexchange.com/questions/134767/…. Using IPv6 will not help you in any way in getting rid of attacks on IPv4.
    – Teun Vink
    Sep 6 '18 at 5:13
  • Your best option would be to have your upstream ISP filter or block unwanted traffic in some way, automated by using RTBH or semi-automated by entering something on their customer portal. If your ISP is unable to help you, scrubbing centers are another option (but sometimes costly), else, I'd really consider looking for another ISP.
    – Teun Vink
    Sep 6 '18 at 5:15
  • 1
    Most ISPs have a mechanism for more sophisticated clients to set the flowspec filtering within the ISP's network. This is in addition to the ISPs own quantity-based DDoS detection and automated response. In our case we use a second mulithop BGP feed from the client's IDS system to our server (Our server then scrubs the client's flowspec of any non-permitted configuration, such as flowspecs referring to other client's traffic). But some ISPs use REST APIs. At this point in time there's no "industry standard" mechanism. You'll need to speak with the ISP.
    – vk5tu
    Sep 7 '18 at 0:03
  • 1
    If you implement flowspec then those rules work in your network. But denial of service which uses quantity of traffic can't be controlled from your network -- by the time that traffic hits your exterior interface the ISP-client link has already been congested. It has to be controlled from the ISP's network. The question for your ISP is what mechanisms they have to do that. The actually mechanism -- REST API, BGP signalling via flowspec, web page, nothing at all -- varies by ISP.
    – vk5tu
    Sep 7 '18 at 2:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.