{"id":19009,"date":"2024-01-30T11:29:31","date_gmt":"2024-01-30T11:29:31","guid":{"rendered":"https:\/\/made4it.com.br\/blog\/what-is-flowspec-how-to-use-flowspec-to-mitigate-ddos-attacks\/"},"modified":"2026-07-01T15:10:29","modified_gmt":"2026-07-01T15:10:29","slug":"what-is-flowspec-how-to-use-flowspec-to-mitigate-ddos-attacks","status":"publish","type":"post","link":"https:\/\/made4it.com.br\/en\/blog\/what-is-flowspec-how-to-use-flowspec-to-mitigate-ddos-attacks\/","title":{"rendered":"What is FlowSpec? How to use FlowSpec to mitigate DDoS attacks?"},"content":{"rendered":"\n

Today we’re going to talk a bit about BGP Flowspec and its effectiveness in mitigating DDoS attacks. <\/p>\n\n

What is Flowspec?<\/strong> <\/h2>\n\n

BGP Flow Specification (Flowspec)<\/strong> is defined in RFC 5575<\/strong>(Dissemination of Flow Specification Rules)<\/em>, <\/em>defines how Flowspec<\/strong> is used to distribute flow rules through the BGP protocol. <\/p>\n\n

Essentially, Flowspec<\/strong> is an extension of the BGP protocol that allows routers to apply rules\u2014such as dynamic ACLs or dynamic firewall rules\u2014to specific types of traffic. These rules can be based on a variety of criteria, including source, destination, protocol, port, and so on. <\/p>\n\n

Below is a table with all the possibilities for classifying Flowspec traffic: <\/p>\n\n

BGP Flowspec NLRI Type<\/strong> <\/td>QoS Match Fields<\/strong> <\/td><\/tr>
Type 1 <\/td>Destination IP \/ IPv6 address <\/td><\/tr>
Type 2 <\/td>Source IP \/ IPv6 address <\/td><\/tr>
Type 3 <\/td>IP \/ IPv6 Protocol <\/td><\/tr>
Type 4 <\/td>Source or destination port <\/td><\/tr>
Type 5 <\/td>Destination port <\/td><\/tr>
Type 6 <\/td>Source port <\/td><\/tr>
Type 7 <\/td>ICMP Type <\/td><\/tr>
Type 8 <\/td>ICMP Code <\/td><\/tr>
Type 9 <\/td>TCP flags <\/td><\/tr>
Type 10 <\/td>Packet length <\/td><\/tr>
Type 11 <\/td>DSCP <\/td><\/tr>
Type 12 <\/td>Fragmentation bits <\/td><\/tr><\/tbody><\/table><\/figure>\n\n

These types of classification can also be combined, for example: <\/p>\n\n

Flow with Source 8.8.8.8\/32 source UDP port 53. <\/p>\n\n

Based on the traffic classifications above (from the table or a combination thereof as in the example), we can take the following actions: <\/p>\n\n

Type<\/strong> <\/td>Description<\/strong> <\/td>PBR Action<\/strong> <\/td><\/tr>
0x8006 <\/td>traffic-rate <\/td>Drop | Police <\/td><\/tr>
0x8007 <\/td>traffic-action <\/td>Terminal Action + Sampling <\/td><\/tr>
0x8008 <\/td>redirect-vrf <\/td>Redirect VRF <\/td><\/tr>
0x8009 <\/td>traffic-marking <\/td>Set DSCP <\/td><\/tr>
0x0800 <\/td>Redirect IP NH <\/td>Redirect IPv4 or IPv6 Next-Hop <\/td><\/tr><\/tbody><\/table><\/figure>\n\n

How does Flowspec work?<\/strong> <\/h2>\n\n
\"What\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n

For FlowSpec to work <\/strong>, you must establish BGP FlowSpec sessions between the BGP router specified in the Edge Topology and the server\/router that generates the FlowSpec rules\u2014which, in our topology, is our software, Made4Flow. <\/p>\n\n

FlowSpec works <\/strong>by sending a special BGP message to the router. This message contains a list of flow rules that the router must apply. Flow rules can be applied to all traffic passing through the router or only to specific traffic; just like with a firewall rule, you can choose which traffic to apply an action to. <\/p>\n\n

If your carrier or transit provider supports FlowSpec<\/strong>, it is important to request BGP FlowSpec<\/strong> sessions, as this allows us to send the FlowSpec <\/strong>rules to <\/strong>be applied directly on your carrier\u2019s equipment, and thus malicious traffic will not reach our equipment, thereby preventing your links from becoming overloaded. <\/p>\n\n

How can FlowSpec help defend against DDoS attacks?<\/strong> <\/h2>\n\n

To use FlowSpec to mitigate DDoS attacks<\/strong>, you need to use an attack detection tool that generates FlowSpec <\/strong>rules, such as \n Made4Flow<\/a>\n<\/strong>. <\/p>\n\n

When the NetFlow Network Analyzer detects a DDoS attack<\/strong>, it generates a special BGP message containing the flow rules needed to mitigate the attack. This message is then sent to the router, which applies the rules and prevents the malicious traffic from reaching its final destination, as shown in the example below, where we see a blocking rule for a destination IP address and ICMP type 0 or 8: <\/p>\n\n

\"What\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n

Another way to use FlowSpec to mitigate DDoS attacks<\/strong> is to use FlowSpec <\/strong>to limit the rate of traffic that can be sent to a given destination<\/strong>. This can help prevent a DDoS <\/strong>attack from saturating the destination’s bandwidth, as in the example below: <\/p>\n\n

\"What\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n

As we saw in the examples above, FlowSpec sends <\/strong>rules to drop or rate-limit<\/em><\/strong> the attacked prefixes or IP addresses. This prevents the DDoS attack from passing through our BGP\/edge router into the network<\/strong>. To make FlowSpec more effective against DDoS attacks<\/strong>, it is important to establish a BGP FlowSpec<\/strong> session with your service providers, thereby increasing the effectiveness of the protection. Blocking can then be performed directly on your carrier\u2019s equipment and routers, preventing packets and traffic from reaching your equipment and avoiding issues such as high CPU usage, link overload, and even loss of communication with your devices. <\/p>\n\n

Unfortunately, not all operators offer BGP FlowSpec<\/strong> sessions. Check with your operators and, if possible, set up BGP FlowSpec <\/strong>sessions so that if you experience DDoS attacks, you can reduce the impact on your network and increase your protection by creating the rules directly on your routers. <\/p>\n\n

Conclusion<\/h2>\n\n

BGP FlowSpec<\/strong> is an effective tool that can be used to mitigate DDoS attacks of all sizes<\/strong>. Using FlowSpec<\/strong>, network administrators can direct DDoS traffic to a mitigation point or limit the rate of traffic that can be sent to a particular destination<\/strong>. <\/p>\n\n

Stay tuned for the next few articles, as we’ll be talking about how to configure BGP FlowSpec<\/strong> sessions on different manufacturers such as Huawei, Juniper, Cisco, Nokia and various other models and brands<\/strong>. <\/p>\n\n

\n
Get to know Made4Flow<\/a><\/div>\n<\/div>\n\n
\"What<\/figure>\n","protected":false},"excerpt":{"rendered":"

Essentially, Flowspec is an extension of the BGP protocol that allows routers to apply rules\u2014such as dynamic ACLs or dynamic firewall rules\u2014to specific types of traffic. These rules can be based on a variety of criteria, including source, destination, protocol, port, and so on. <\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[889,872,1337,1416,1311,902],"tags":[1417,903,1418],"class_list":["post-19009","post","type-post","status-publish","format-standard","hentry","category-about-made4flow","category-bgp","category-ddos","category-flowspec","category-made4flow","category-netflow","tag-flowspec","tag-made4flow","tag-what-is-flowspec"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t