BGP FlowSpec: mitigation without taking the service down
A full blackhole also kills legitimate traffic. ITCSECadmin injects FlowSpec rules straight to your BGP peers — upstreams drop only the attack flows while your services keep running. No scrubbing-center contract required.
Let's talk FlowSpec in your networkHow it works
- Rule injection to upstream peers via ExaBGP v5 (RFC 5575) — no extra licensing
- Match criteria: destination and source prefix, protocol, dst/src ports (lists and ranges), TCP flags, DSCP, fragments
- Actions: drop (null-route only matching flows) or rate-limit with configurable kbps per neighbor
- Non-blocking injection queue — the detection pipeline never waits for BGP announcements
IPv6 and automation
- IPv6 FlowSpec (RFC 8956) on the same MP-BGP session as IPv4 — no separate neighbor needed
- Automatic rule withdrawal when the threat expires (configurable lifetime)
- Full per-rule, per-neighbor status tracking: pending / active / withdrawn / failed
- Manual inject and withdraw from the FlowSpec module and directly from the threat details page
Management and operational safety
- FlowSpec module: live ExaBGP status, neighbor CRUD, active rules, history linked to threats
- One-click exabgp.conf generator — preview before write, applied via a secure sudoers rule
- Test CLI verifying ExaBGP connectivity in real time; start guards when configuration is incomplete