elective DDoS Blackholing: How to Protect a Single IP Address Without Affecting the Rest of the Network

Blackholing, or RTBH (Remotely Triggered Black Hole), is one of the basic anti-DDoS protection mechanisms used by ISPs and data centers. The principle is simple: when traffic to a given IP address exceeds a defined threshold, the edge router starts dropping all traffic directed to that address. It is an effective method of defending the network against a volumetric attack, but it has one significant drawback: the attacked host becomes unavailable, exactly as during the attack itself.

In practice, network operators often face a dilemma: trigger blackholing and protect the rest of the infrastructure at the cost of one customer's availability, or risk overloading the link and other devices in the network. LiveShield can partly resolve this dilemma thanks to the selective blackholing mechanism.

Standard blackholing works at the level of an entire subnet or a single address, with one set of attack detection thresholds applied globally. Selective blackholing in LiveShield lets you define separate traffic thresholds for a specific address with a /32 mask, independently of the rules applying to the rest of the protected network.

In practice, this means the administrator can create a separate blackholing profile with individual pps and bps thresholds for a chosen host and assign it to a specific prefix. LiveShield respects the principle known from IP routing: a more specific prefix (/32) takes precedence over rules defined for a broader subnet. As a result, a server that naturally generates high traffic, for example a test host such as a speedtest server or a streaming server, can have raised attack detection thresholds without having to change the protection configuration for the rest of the network.

Blackholing thresholds can also be defined per protocol, in total for the IP address or separately for TCP and UDP traffic, depending on the characteristics of the protected service.

In LiveShield, the FlowSpec filtering and blackholing mechanisms operate independently of each other and are checked in parallel. This means that for the same prefix you can set lower attack detection thresholds that trigger FlowSpec rules and higher blackholing thresholds as a safeguard in case FlowSpec filtering proves insufficient. In a typical scenario, the FlowSpec rules react first, and blackholing serves as the last line of defense, triggered only when the attack escalates further.

This approach makes it possible to build multi-level anti-DDoS protection, from precise filtering of specific traffic types, through raised thresholds for selected hosts, to full blackholing as an emergency safeguard.

For ISPs and data centers, selective blackholing is a tool that makes it possible to better match anti-DDoS protection to the real traffic characteristics in the network, instead of applying one universal threshold to all addresses. The ability to configure separate thresholds per prefix, combined with the parallel operation of FlowSpec and blackholing, gives the flexibility needed to protect infrastructure with a diverse traffic profile, from service servers with stable load to hosts generating natural traffic peaks.

More information on configuring blackholing and FlowSpec thresholds in LiveShield can be found in the technical documentation.