What is BGP FlowSpec?

BGP FlowSpec is a BGP extension, defined in RFC 8955 (which obsoleted RFC 5575), that distributes granular traffic-filtering rules over BGP sessions instead of plain routes. A single rule describes a flow by multiple criteria (source and destination address, protocol, ports, packet length, TCP flags, fragmentation) and binds it to an action such as dropping packets, rate-limiting, redirecting to a VRF or marking DSCP. This lets an operator block exactly the attack traffic without sacrificing an entire prefix the way RTBH does.

How FlowSpec works

FlowSpec uses a dedicated BGP address family: for IPv4 it is AFI/SAFI 1/133, for IPv6 it is 2/133, and the L3VPN variant uses SAFI 134. Rules ride the same machinery as routes but in a separate NLRI. A match rule is built from filter components, and actions are encoded as BGP extended communities. A router that receives a FlowSpec advertisement validates it and, on acceptance, installs the rule in hardware (ASIC) as a filter entry running at line rate.

• Match components (types 1 to 12): destination prefix, source prefix, IP protocol, port, source and destination port, ICMP type and code, TCP flags, packet length, DSCP and fragment.
• Actions (encoded as extended communities): traffic-rate (discard by setting 0 b/s, or rate-limit), traffic-action (sample or terminal bit), redirect to VRF, redirect to IP, and traffic-marking (DSCP rewrite).
• Validation: by default a router accepts a rule only if its originator is the best path to the destination prefix, which guards against injection of bogus filters.
• Distribution: rules can be propagated inside an AS (iBGP, route reflectors) and between autonomous systems (eBGP), including to an upstream provider.

FlowSpec vs RTBH

RTBH (Remotely Triggered Black Hole) works at the level of a whole prefix: you advertise a route with a blackhole community, and all traffic to that address is dropped at the network edge or upstream. It is simple and widely supported, but coarse, because it also cuts legitimate traffic to the target, ending the attack at the cost of the victim's availability. FlowSpec is more precise: it filters by port, protocol or packet length, so the service stays reachable for legitimate traffic, and instead of a hard drop you can rate-limit or redirect to scrubbing. The price is greater complexity, the risk of exhausting TCAM/ASIC resources, and uneven support across platforms.

Use cases and limitations

FlowSpec is used mainly for automated DDoS mitigation. A detection system (NetFlow/IPFIX) generates rules matched to the attack signature and distributes them within seconds. It is also used to enforce filtering policy in large networks. Keep the limits in mind, though: the number of rules a device can install in hardware is finite, and a poorly built inter-domain rule can block traffic more broadly than intended. That is why many networks restrict the accepted actions (for example to discard and rate-limit only) and require strict validation.

FlowSpec on the AS202520 SkyPass network

AS202520 SkyPass supports FlowSpec and RTBH as part of Anti-DDoS protection for IP transit and peering customers. We distribute FlowSpec rules from our edge routers in the Warsaw and Wrocław PoPs, blocking or rate-limiting attack traffic more precisely than blackholing alone, before it saturates the uplink. For customers peering at Polish IXPs (THINX, TPIX, WRIX, POZIX, 1-IX) and using remote access to those exchanges, we combine FlowSpec, RTBH and scrubbing into a coherent mitigation model tuned to link capacity and attack profile.