BGP FlowSpec

What FlowSpec does

BGP distributes reachability information. FlowSpec adds routes containing traffic-match conditions and actions, such as discarding or rate-limiting matching packets.

A single FlowSpec route can distribute the same filter to multiple routers, reducing configuration time and inconsistency during an attack.

Technical details

A FlowSpec route contains match conditions and an action. Conditions can include source and destination prefixes, IP protocol, ports, packet length and TCP flags.

Once the route is accepted, the receiving router installs a corresponding filter in hardware or software, depending on platform capabilities.

Typical matches

• Destination prefix under attack
• Specific protocol such as UDP or TCP
• Source or destination ports
• TCP flags such as SYN
• Packet length or fragment patterns

Where FlowSpec fits

FlowSpec distributes simple filtering decisions across multiple routers and is commonly used for coordinated response to large attacks.

FlowSpec does not replace session validation or application-protocol checks. Those checks require other filtering systems.

Limits and caveats

Hardware support is not identical across vendors and platforms. Some devices support only part of the FlowSpec feature set, and some actions may be implemented in slower paths depending on the router.

Enforcement depends on the receiving platform's FlowSpec support and forwarding path. Distribution of a route does not guarantee identical hardware enforcement on every device.

Use during DDoS events

FlowSpec reduces the time required to apply the same filter across multiple edge or mitigation routers.