OcNOS 6.3 Generally Available: 400G Aggregation, IPoDWDM, and BGP DDoS Prevention

OcNOS 6.3 is now generally available. This release strengthens the OcNOS ecosystem across Aggregation Router, Cell Site Router, Data Center, and Routed Optical Networking use cases, with new hardware platforms and a broad set of software features targeting service provider and data center operators.

New Platform: 400G Aggregation Router

OcNOS 6.3 introduces support for the UfiSpace S9600-56DX — a high-density aggregation router platform featuring 8×400G QSFP-DD and 48×100G QSFP28 interfaces. This platform enables service providers to aggregate high-throughput traffic at the metro edge while supporting transport services including IPoDWDM.

Key Software Features in OcNOS 6.3

IPoDWDM: Converged IP and Optical

OcNOS 6.3 advances the IP over DWDM story by enabling 400G coherent optical interfaces to be managed directly via the OcNOS CLI — eliminating the need for a separate optical NMS for ZR/ZR+ transponders. Operators can configure optical parameters (frequency, modulation, TX power) alongside IP routing configuration in a single management plane.

BGP DDoS Prevention via FlowSpec

OcNOS 6.3 adds BGP FlowSpec support for automated DDoS mitigation at the network edge. When a DDoS attack is detected, FlowSpec rules are distributed via BGP to all participating routers simultaneously — dropping or rate-limiting attack traffic at the ingress point closest to the source, before it reaches the target.

! OcNOS -- BGP FlowSpec DDoS mitigation
!
configure terminal
!
! Step 1: match the attack traffic
class-map type traffic match-all VICTIM
  match destination-address ipv4 203.0.113.50/32
  match protocol tcp
  exit
!
! Step 2: the action, as a PBR policy. OcNOS polices the matched flow, and
! rate 1 bps is the minimum the policer accepts, so it acts as a drop.
policy-map type pbr DDOS-BLOCK
  class type traffic VICTIM
    police rate 1 bps
    exit
  exit
!
! Step 3: bind the policy into the FlowSpec address family
flowspec
  address-family ipv4
    service-policy type pbr DDOS-BLOCK
    exit
  exit
!
! Step 4: exchange FlowSpec routes with the peer.
! In production the rules are normally pushed by a DDoS scrubbing controller.
router bgp 65001
  address-family ipv4 flowspec
    neighbor 10.0.0.2 activate
    exit-address-family
  exit
!
commit
exit
!
! Verify the FlowSpec rules are installed:
show ip bgp flowspec
show ip bgp flowspec summary

Segment Routing Improvements

OcNOS 6.3 introduces IS-IS micro-loop avoidance — a complementary mechanism to TI-LFA that prevents transient forwarding loops during network convergence. See the dedicated micro-loop avoidance guide for configuration details.

Power Savings

OcNOS 6.3 introduces platform-level power management features including dynamic port power-down for unused interfaces and thermal management improvements, reducing operational power consumption across deployed platforms.

• OcNOS 6.4 — What's New
• ISIS Micro-loop Avoidance in OcNOS 6.3
• OcNOS 功能矩阵
• OcNOS-SP | OcNOS-DC
• 联系 IP Infusion

IP Infusion Product Team