What is RTBH?

RTBH (Remote-Triggered Blackhole) is a BGP-based technique that, on an operator's request, discards all traffic destined for a chosen address or prefix before it reaches the attacked target. It works by announcing a route tagged with a special BGP community (a blackhole community), on the basis of which the provider's routers send that route's traffic to a discard interface (Null0). RTBH is one of the most widely used and cheapest mechanisms for limiting the impact of DDoS attacks on IP networks.

How RTBH works

The most common variant is destination-based RTBH. When a destination address (for example a /32 in IPv4 or /128 in IPv6) becomes the target of a volumetric attack, the victim's operator announces that prefix over BGP toward the transit provider with a blackhole community attached. The provider, seeing this community on the customer session, sets the prefix's next-hop to a Null0 interface and drops the packets at its own edge, close to the attack sources. As a result the customer's bandwidth and links are not saturated. There is also source-based RTBH, which filters on the source address and usually relies on uRPF, but it is used less often because attacks commonly spoof source addresses.

Blackhole communities and the RFC 7999 standard

To trigger blackholing, the prefix must carry an agreed BGP community. Historically each operator defined its own value, which hurt interoperability. RFC 7999 introduced the well-known BLACKHOLE community with the value 65535:666, which more and more networks and internet exchanges now recognise. The key deployment rules include:

• The standard well-known BLACKHOLE community is 65535:666 (RFC 7999).
• The most specific prefixes are usually accepted: /32 for IPv4 and /128 for IPv6.
• The provider must trust the announcement, so blackholing only works for addresses belonging to the customer.
• Blackhole routes should not be propagated further without control, so attackers cannot abuse them.
• Some IXPs offer blackholing on their route servers, spreading the discard across many peers.

Strengths and limits of RTBH

The main strength of RTBH is speed and simplicity: a single BGP announcement is enough to cut off attack traffic within seconds and protect the rest of the infrastructure. The mechanism needs no expensive scrubbing appliances and scales well. There is, however, an important limitation: destination-based RTBH drops all traffic to the attacked address, including legitimate traffic, so the targeted host becomes unreachable. RTBH is therefore a surgical tool that saves the network at the cost of one target, not a way to keep the service online. Where selective filtering is needed, operators use BGP FlowSpec (RFC 8955) or traffic cleaning in scrubbing centres.

RTBH in the AS202520 SkyPass network

AS202520 SkyPass offers blackholing to BGP transit and peering customers, accepting /32 (IPv4) and /128 (IPv6) announcements with the BLACKHOLE community 65535:666 and our own network communities. With points of presence in Warsaw and Wrocław and peering at Polish IXPs (THINX, TPIX, WRIX, 1-IX), attack traffic is discarded close to the source before it saturates the customer's links. RTBH is the first, fastest layer of our anti-DDoS protection, complemented when needed by more selective filtering mechanisms.