What Is BGP FlowSpec and Why Does It Change ISP Network Protection?

BGP FlowSpec is an extension of the BGP protocol that lets you distribute precise traffic-filtering rules (based on address, protocol, port, TCP flags and other packet characteristics) directly to edge routers, using the same infrastructure that already carries routing information, without logging in to each device and entering separate ACLs by hand. For an ISP, this means being able to stop a DDoS attack close to the network edge, precisely and without manual intervention on the hardware.

It is one of the fundamental mechanisms behind modern DDoS protection in operator networks, and a term that comes up in almost every conversation about choosing an anti-DDoS system for an ISP. That is why it is worth understanding it thoroughly before comparing specific solutions.

Standard BGP carries information on how to reach a given network (routing information). FlowSpec extends the same BGP session so that it can also carry traffic-filtering rules: information on which traffic should be dropped, rate-limited or redirected, defined by specific packet characteristics such as source and destination address, protocol, port, TCP flags, packet size or ICMP type.

A router that receives such a rule over a BGP session installs it directly in its hardware forwarding path (provided it supports this, which is a topic in itself, covered separately in our article on router compatibility with FlowSpec) and starts dropping only the packets that match the defined signature. All remaining traffic, including traffic sent to the same IP address, passes through undisturbed.

This is a fundamental difference from the traditional approach, in which the operator would have to log in to every edge router and enter an ACL separately, device by device. That process is too slow to keep up with an attack lasting a few minutes, and with a larger number of routers it is practically impossible to do in real time.

Ordinary BGP answers the question "how do I reach this network?" FlowSpec answers the question "what should be done with traffic that has these specific characteristics?" Both types of information travel over the same BGP infrastructure, the same sessions to the same neighbors, but FlowSpec carries a completely different kind of instruction: not "where to send the packet", but "whether to let it through at all, and under what conditions".

Because of this, FlowSpec can be deployed without building separate, dedicated infrastructure for distributing filtering rules. It is enough that the edge routers support this protocol extension and have a BGP session configured with the system that generates the rules.

FlowSpec and RTBH (Remotely Triggered Black Hole) are two different attack-response mechanisms, often confused with each other even though they work with completely different levels of precision. RTBH cuts off all traffic destined for a given IP address, including legitimate traffic. FlowSpec cuts off only the packets that match a specific attack signature, leaving the rest of the traffic to the same address unchanged.

That is why a good anti-DDoS architecture treats FlowSpec as the first line of defense and RTBH as an emergency mechanism, triggered only when FlowSpec filtering alone is no longer enough, for example when an attack approaches link saturation. We discuss this topic separately in our article on minimizing the side effects of mitigation.

LiveShield has its own BGP daemon (based on GoBGP) and fully supports generating and distributing FlowSpec rules, with no need for manual ACL configuration on the operator's side. The system analyzes traffic in real time, detects an attack based on configured per-protocol thresholds, and then automatically generates a FlowSpec rule matched to the specific attack vector and announces it over a BGP session to the edge router. The entire process, from detection to deployment of the first rule, takes place without operator intervention.

In practice, this means the operator configures the BGP session between LiveShield and their routers once, and from then on every subsequent FlowSpec rule is generated and distributed automatically, based on current traffic analysis. This also applies to setups with multiple edge routers at once: the rule is announced once, via BGP, to all neighbors that have the appropriate session configured, instead of requiring separate configuration on each device.

One condition should be kept in mind regardless of which system you use to generate FlowSpec rules: the fact that a router "supports BGP FlowSpec" in the control plane does not mean it will apply the rule in the hardware forwarding path. Which hardware platforms actually support FlowSpec in practice is described in detail in a separate article. It is worth verifying before choosing an anti-DDoS system, regardless of the vendor.

BGP FlowSpec is a mechanism for distributing precise traffic-filtering rules over the same BGP infrastructure that already carries routing information, without manual ACL configuration on each device. Unlike RTBH, which blocks all traffic to a given address, FlowSpec makes it possible to cut off only the traffic matching the attack signature, keeping the service running for legitimate traffic. LiveShield generates and distributes FlowSpec rules fully automatically, based on current traffic analysis, thanks to its own BGP daemon integrated with the operator's existing infrastructure, with no need to deploy additional components or perform manual work during an attack.

What is BGP FlowSpec in simple terms? It is an extension of the BGP protocol that lets you send precise traffic-filtering rules to routers (e.g. "drop UDP packets from this source to this port") over the same infrastructure that carries routing information, without manually configuring ACLs on each device.

How does FlowSpec differ from RTBH? FlowSpec filters precisely, based on specific packet characteristics, leaving the rest of the traffic to a given address unchanged. RTBH blocks all traffic to an IP address, including legitimate traffic. It is a less precise mechanism, usually used as an emergency safeguard.

Does every router support BGP FlowSpec? Support for FlowSpec in the BGP control plane does not automatically mean that the router will apply the rule in the hardware forwarding path. This depends on the specific model, software version and license. It is worth verifying before deployment.

Does deploying FlowSpec with LiveShield require manual rule configuration during an attack? No. LiveShield automatically generates and distributes FlowSpec rules based on current traffic analysis, through its own BGP daemon integrated with the operator's routers. The operator configures the BGP session once, and subsequent rules are created without manual intervention.