case studies
BGP FlowSpec DDoS Mitigation: In-House Scrubbing VRF Design
Automated BGP FlowSpec DDoS mitigation with a dedicated scrubbing VRF
Customer Story
Building BGP FlowSpec DDoS mitigation in house sounds like something only Tier 1 carriers do. It is not. This is the design we deployed for one of our customers and have since replicated across several networks under our management: FastNetMon for detection, FlowSpec redirect-to-VRF for diversion, and a dedicated scrubbing VRF with a single exit. The largest attack it has handled to date was around 180 Gbps, mitigated automatically, with the victim online throughout.
Engineering
Client: Non Disclosure
Industry: Service Provider
Services: Professional Network Services, 24/7 NOC
Technologies: BGP, FlowSpec, IPFIX, VRF, FastNetMon
Why BGP FlowSpec DDoS mitigation beats RTBH
Remotely Triggered Black Hole filtering has been the standard ISP answer to volumetric DDoS for two decades. It is simple, it is supported everywhere, and it protects the network. The problem is what it does to the customer: RTBH drops all traffic to the victim IP, including legitimate traffic. The attacked service goes completely dark. From the attacker’s perspective, RTBH is a success condition.
Cloud scrubbing services solve that, but at a price. Per-Gbps billing, BGP diversion of entire prefixes, added latency from hairpinning traffic through a scrubbing center that may sit on another continent, and a dependency on a third party during the worst minutes of your week.
For operators who own their backbone and edge, there is a third option: scrub in house.
Architecture overview
Our BGP FlowSpec DDoS mitigation design has three functional layers:
- Detection: FastNetMon receiving IPFIX from all edge routers
- Diversion: BGP FlowSpec with a redirect-to-VRF action, injected automatically
- Scrubbing: a dedicated scrubbing VRF whose only exit is the scrubbing appliance, with clean traffic returned to the clean VRF
No traffic leaves the operator’s network at any point. Under normal conditions, the scrubbing path carries zero traffic and adds zero latency.
Detection: IPFIX into FastNetMon
Every edge router exports IPFIX to FastNetMon. This is telemetry the platforms already support, so the detection layer needs no new hardware in the forwarding path and no inline element that could become a failure point itself.
FastNetMon evaluates per-host thresholds in real time: bandwidth, packet rate, and per-protocol signatures. Thresholds are tuned per customer segment, because a hosting subnet and a residential broadband pool have very different baselines.
Diversion: FlowSpec redirect-to-VRF
When a destination crosses its threshold, FastNetMon executes a trigger script. The script generates a BGP FlowSpec route matching the victim IP, carrying a redirect-to-VRF extended community.
The FlowSpec route propagates to all edge routers over the existing BGP infrastructure. From that moment, every edge steers traffic destined to the victim into the scrubbing VRF. Two properties make this surgical:
- Only the victim’s traffic is diverted. The rest of the network forwards normally, and other customers never notice the attack.
- The diversion happens at every entry point simultaneously. Attack traffic is caught at the edge it arrives on, not backhauled across the core before filtering.
Operationally, BGP FlowSpec DDoS mitigation is nearly identical to RTBH in its trigger mechanism. The difference is the action: instead of discard, redirect.
Scrubbing: a VRF with one exit
The scrubbing VRF is deliberately simple. It contains a single default route pointing toward the scrubbing appliance. Anything redirected into the VRF has exactly one place to go.
The appliance sits inline on direct L2 links between the two VRFs: one leg attached to the scrubbing VRF, the other to the clean VRF. Dirty traffic enters on the scrubbing side, the appliance drops spoofed and malformed packets and absorbs the flood, and legitimate flows exit on the clean side, where they rejoin the normal forwarding path toward the victim. There is no tunneling, no re-injection tricks, no risk of a routing loop between dirty and clean paths. The VRF separation guarantees that diverted traffic can only reach the victim by passing through the appliance.
When FastNetMon sees the attack subside, the FlowSpec route is withdrawn and forwarding returns to the direct path automatically. The whole cycle, from detection to mitigation to cleanup, runs without human intervention.
Results: 180 Gbps mitigated with zero downtime
- Largest attack mitigated to date: approximately 180 Gbps
- Victim downtime during attacks: none
- Manual intervention required per event: none
- Added latency outside of attack conditions: zero, the scrubbing path is idle until FlowSpec activates it
Lessons from production
Tune thresholds before you automate. An automated FlowSpec injection with badly tuned thresholds will divert legitimate traffic spikes. We run new deployments in detect-only mode first and review every would-have-triggered event before enabling automatic diversion.
Validate FlowSpec behavior per platform and per release. Redirect-to-VRF support and behavior vary between vendors and software versions. Test in the lab with realistic attack replay before trusting it at the production edge.
Size the scrubbing path for your real attack profile. You do not need to scrub terabits. Look at your historical attack data and size the appliance and the scrubbing links for the attacks you actually receive, with headroom. Our 180 Gbps event validated the sizing exercise we did upfront.
Keep the scrubbing VRF boring. One default route, no policy complexity. Every additional route in that VRF is a future incident.
Where this fits
BGP FlowSpec DDoS mitigation in house suits operators who own their edge and want deterministic, low-latency mitigation without per-attack billing. It does not replace upstream capacity planning: if an attack saturates your transit links, no internal scrubbing helps, and that is where upstream filtering or a hybrid overflow model enters the picture.
If you want a second pair of eyes on your DDoS mitigation design, or you want this deployed and operated in your network, talk to us.
faq
Can BGP FlowSpec redirect traffic to a scrubbing VRF?
Yes. FlowSpec supports a redirect-to-VRF action via an extended community. The route matches the victim IP and steers only that traffic into a dedicated VRF at every edge router simultaneously, while all other traffic forwards normally.
Is in-house DDoS scrubbing better than a cloud scrubbing service?
For operators who own their edge, in-house scrubbing avoids per-Gbps billing, added latency from traffic hairpinning, and third-party dependency during an attack. Cloud or hybrid scrubbing still makes sense when attacks exceed your transit capacity.
Why is RTBH not enough for DDoS mitigation?
RTBH drops all traffic to the victim IP, including legitimate traffic, which completes the attacker’s goal. FlowSpec redirect-to-VRF diverts only the victim’s traffic through a scrubbing appliance, so the service stays online during the attack.
be our next success story!
Drop us a line! We care for your Business and are here to answer your questions 24/7