BGP FlowSpec DDoS mitigation on your edge routers

IP Infusion delivers DDoS mitigation on the routers at your edge: OcNOS-SP samples traffic with sFlow, takes BGP FlowSpec and RTBH rules from a FastNetMon detector, and drops or rate-limits the attack in hardware within two seconds, without rerouting traffic to a scrubbing center.

Book an architecture review Get the DDoS solution brief
<2 sfrom detection to mitigation
26OcNOS-SP platforms with BGP FlowSpec
600+operators run OcNOS

How the edge router stops an attack

The edge router sends sFlow samples to FastNetMon. When traffic to a host crosses a configured threshold, FastNetMon sends a mitigation rule to the router over BGP, and the router enforces it in hardware. The rule can match only the attack flow, or everything sent to the host.

The same attack, two ways to stop it

An edge router running OcNOS-SP sends sFlow to FastNetMon, receives a FlowSpec rule or an RTBH route over BGP, and drops or rate-limits the attack FastNetMondetection, partner product sFlow samples FlowSpec rule over BGP RTBH route over BGP Internettransit and peering Edge routerOcNOS-SPenforces in hardware Target hostyour customer unreachable until the route is withdrawn Clean traffic Attack traffic Telemetry

FlowSpec drops only the attack flow. The rule matches the attack, and the router discards or rate-limits it in hardware while other traffic to the host keeps flowing.

Illustrative.

Tested with FastNetMon, step by step

The IP Infusion deployment guide was tested on OcNOS 7.0.0 with FastNetMon 2.0.367 and later. It covers the sFlow export, the BGP session, FlowSpec and RTBH, thresholds, and failover.

FastNetMon runs as a virtual machine and is supported by FastNetMon. If it stops, the BGP session times out and the router withdraws its rules, so traffic returns to its normal path.

Get the deployment guide →

What the edge router enforces

All 26 OcNOS-SP platforms support BGP FlowSpec and RTBH, and the router adds its own protections.

CapabilityWhat it doesWhere
BGP FlowSpecTakes filter rules from the detector over BGP and installs them in hardware. The action is discard or rate-limit.All OcNOS-SP
FlowSpec per VRFSeparate FlowSpec policies for each tenant VRFAll OcNOS-SP
RTBHRoutes from the detector point the target at a null next-hop, with the IANA BLACKHOLE communityAll OcNOS-SP
sFlowSamples ingress traffic at a configured rate and sends it to the collector in-bandAll OcNOS-SP
IPFIXFlow export as an alternative to sFlowOcNOS-SP
uRPF, strict and looseDrops packets with spoofed source addressesAll OcNOS-SP
Hardware ACLsMatch on addresses, protocol, ports, TCP flags, DSCP and fragments, with timed rulesAll OcNOS-SP
Control plane policingConfigurable CoPP protects the router’s own CPUSelected platforms
Fail-safeIf the detector stops, the BGP session times out after its hold timer and the router withdraws its rulesAll OcNOS-SP

One hardware-profile command offloads FlowSpec rules to the ASIC. As of OcNOS 7.0, FlowSpec supports IPv4; use RTBH for IPv6 attacks. Support varies by platform: check the OcNOS Feature Matrix.

Detection-to-mitigation in seconds.

The architecture brief and the deployment app note: the high-level picture plus the step-by-step configuration for BGP Flowspec and RTBH on OcNOS with FastNetMon.

BGP FlowSpec DDoS Mitigation: OcNOS + FastNetMon

How OcNOS-SP edge routers and FastNetMon detect and stop DDoS attacks with BGP FlowSpec and RTBH, within two seconds.

Get the brief

Automated DDoS Mitigation: Deployment Guide

Step-by-step configuration: BGP Flowspec policies, RTBH triggering, FastNetMon integration with OcNOS, the ready-to-deploy reference.

Get the app note

Edge routers that enforce it

BGP FlowSpec and RTBH are supported on all 26 OcNOS-SP platforms. Pick the router by the edge it protects.

UfiSpace S9510-28DC router

Aggregation edge

UfiSpace S9510-28DC

Qumran 2A · 800 Gbps

24 × 25G, 2 × 100G, 2 × 400G

Edgecore AS7946-30XB router

Metro and core

Edgecore AS7946-30XB (AGR400)

Qumran 2C · 2.4 Tbps

4 × 25G, 22 × 100G, 4 × 400G

UfiSpace S9600-56DX router

Metro edge

UfiSpace S9600-56DX

Qumran 2C · 4.8 Tbps

4 × 25G, 48 × 100G, 8 × 400G

UfiSpace S9610-36D router

Peering and transit edge

UfiSpace S9610-36D

Jericho2C+ · 14.4 Tbps

36 × 400G

Every model on the OcNOS Hardware Compatibility List with OcNOS-SP can enforce FlowSpec and RTBH.

DDoS mitigation with OcNOS: FAQ

What is BGP FlowSpec DDoS mitigation?
BGP FlowSpec (RFC 8955) carries traffic filter rules inside BGP. A detector such as FastNetMon announces a rule that matches the attack, and an OcNOS-SP router installs it in hardware and discards or rate-limits the matching packets. Other traffic to the same host keeps flowing.
How fast does the router stop an attack?
Within two seconds. The router exports sFlow samples, FastNetMon detects the anomaly against configured thresholds and sends a FlowSpec rule or RTBH route over BGP, which the router enforces in hardware. No manual action is needed during the attack.
When should I use RTBH instead of FlowSpec?
Use FlowSpec when you can describe the attack, so only the attack flows are dropped. Use RTBH for a flood that threatens your links: every packet for the target goes to a null route, legitimate traffic included, until the route is withdrawn. As of OcNOS 7.0, FlowSpec covers IPv4, and IPv6 attacks are handled with RTBH.
What happens if FastNetMon goes down?
The BGP session to the router times out on its hold timer, 90 seconds by default, and the router withdraws the active mitigation rules. Traffic returns to its normal path. For high availability, run more than one FastNetMon instance on the same telemetry.
Which routers enforce BGP FlowSpec and RTBH?
All 26 OcNOS-SP platforms support BGP FlowSpec and RTBH. On physical routers, one hardware-profile command offloads FlowSpec rules to the ASIC. Check each model in the OcNOS Feature Matrix.
Is FastNetMon part of OcNOS?
No. FastNetMon is a partner product that runs as a virtual machine and is supported by FastNetMon. IP Infusion supplies and supports the routers that export the telemetry and enforce the rules, and publishes the deployment guide.

Plan DDoS mitigation for your edge.

We map your peering and transit edge, the FlowSpec and RTBH policy, and the OcNOS-SP routers that enforce it.

Book an architecture review Hardware compatibility list