Free Tool
BGP FlowSpec Rule Builder
Generate BGP FlowSpec rules for surgical DDoS traffic filtering. Define match criteria, select actions, and export ready-to-use configurations for ExaBGP, BIRD, GoBGP, or Cisco IOS-XR.
Or use a preset to get started quickly.
BGP FlowSpec (RFC 5575) distributes traffic filtering rules via BGP. Instead of blackholing entire prefixes (RTBH), FlowSpec lets you surgically drop, rate-limit, or redirect specific traffic patterns: filtering by source/destination IP, protocol, port, packet length, DSCP, and TCP flags.
FlowSpec Match Types
Destination Prefix
The target IP or subnet being attacked. Usually your own prefix (e.g., 203.0.113.0/24). Required for most FlowSpec implementations.
Source Prefix
Filter by source IP or subnet of the attacker. Useful for known botnets or spoofed source ranges. Leave empty to match any source.
Protocol & Port
Match on IP protocol (TCP, UDP, ICMP) and destination/source port numbers. Essential for filtering amplification attacks targeting specific services.
Packet Length
Filter by IP packet size. Amplification attacks often have characteristic packet sizes (e.g., DNS responses >512 bytes, NTP monlist >440 bytes).
TCP Flags
Match specific TCP flag combinations: SYN, ACK, FIN, RST, PSH, URG. Critical for identifying SYN floods (SYN without ACK) or malformed packets.
Actions
Drop discards matching packets. Rate-limit throttles traffic to a specified bps. Redirect sends traffic to a scrubbing VRF for inspection.
Automate FlowSpec with Flowtriq
Flowtriq automatically generates and deploys FlowSpec rules when attacks are detected: no manual configuration needed. Our 4-level auto-escalation moves from local firewall to FlowSpec to RTBH to cloud scrubbing in seconds.
Start Free Trial Learn MoreUnderstanding BGP FlowSpec for DDoS Mitigation
BGP FlowSpec (RFC 5575) extends the Border Gateway Protocol to distribute traffic filtering rules alongside routing information. Unlike traditional RTBH (Remote Triggered Black Hole) routing that drops all traffic to a destination prefix, FlowSpec lets you define granular match conditions: source and destination IP, protocol, port, packet length, DSCP value, and TCP flags. This means you can surgically filter attack traffic while keeping legitimate traffic flowing.
The filtering happens at the upstream router level, before attack traffic reaches your network. When a FlowSpec rule is advertised via BGP, your transit provider's routers install the corresponding filter. This is critical for volumetric attacks that exceed your local link capacity - no amount of on-host filtering helps if your 10 Gbps uplink is saturated with 50 Gbps of attack traffic.
How to Use This Tool
Start with a preset for common attack patterns (SYN flood, UDP flood, DNS amplification) or build rules manually. Define match criteria for the attack traffic you want to filter, choose an action (drop, rate-limit, or redirect to a scrubbing VRF), and generate configuration for your BGP daemon. The tool supports ExaBGP (the most common choice for programmatic FlowSpec), BIRD 2, GoBGP, and Cisco IOS-XR.
Verify with your transit provider that they accept FlowSpec rules on your BGP session before deploying to production. Not all carriers support all action types, and maximum rule counts vary.
Related reading:
Carrier Compatibility Matrix
Not all transit providers accept all FlowSpec actions. Check compatibility before deploying rules.
| Provider | Rate Limit | Discard | Redirect | DSCP Mark | Max Rules |
|---|---|---|---|---|---|
| NTT/GTT | Yes | Yes | Yes | No | 500 |
| Lumen/CenturyLink | Yes | Yes | No | No | 200 |
| Telia | Yes | Yes | Yes | Yes | 1000 |
| Cogent | No | Yes | No | No | 100 |
| Hurricane Electric | Yes | Yes | Yes | No | 250 |
Important: Always test FlowSpec rules on a non-production prefix first. Contact your provider's NOC to confirm their FlowSpec support before relying on it for production mitigation. Some providers require FlowSpec to be explicitly enabled on your BGP session.
FAQ