Blackholing / RTBH

Blackholing (black hole routing) is a network defense technique in which selected traffic is deliberately sent to a null interface (Null0 / discard) and quietly dropped there — with no error message returned to the sender. The packets simply vanish. RTBH (Remotely Triggered Black Hole filtering) is its automated version. From a single point (a trigger router) an operator announces a discard route over the BGP protocol, and every edge router immediately starts throwing away traffic headed for the specified address. It is used mostly to put out volumetric DDoS attacks at Layer 3/4 quickly — the kind that flood a link with sheer packet volume.

How does RTBH work?

RTBH uses an existing iBGP session as a control channel — a sort of internal radio over which routers agree on routes. Instead of logging into each router by hand, the operator enters a single route on a trigger router, and BGP carries it to the rest within seconds. The full cycle looks like this:

1. Discard route — edge routers already hold a static route that points a special next-hop address (for example from the test pool TEST-NET 192.0.2.0/24 or from private RFC 1918 space) to the Null0 interface.
2. Trigger — the operator announces over BGP the prefix of the attacked target (usually a single address, /32) with its next-hop set to that discard address.
3. Propagation — edge routers receive the announcement and locally resolve the next-hop to Null0, so traffic to that prefix is thrown away right at the network ingress.
4. Withdrawal — once the attack subsides, the route is withdrawn and traffic to the target returns to normal forwarding.

Triggering itself is done in two ways. The next-hop method: the trigger router sets the next-hop attribute directly. Or via BGP communities: the route is tagged with a community value, and rules on the edge routers turn that tag into the discard next-hop. The community method is handier, and it dominates in upstream and internet exchange relationships.

Destination-based vs source-based blackholing

There are two RTBH variants, documented notably in RFC 5635:

• Destination-based RTBH — the most common. All traffic headed to the attacked IP is thrown away. It acts instantly and does not care how many sources the attack comes from. The downside: it cuts the victim off from the rest of the internet (more on that shortly).
• Source-based RTBH — traffic from the specified source addresses is thrown away. It requires uRPF (Unicast Reverse Path Forwarding): the router looks at where the packet came from, and if the return route to that source leads to Null0, the uRPF check fails and the packet goes to the bin. It lets you block the attacker without taking the target down, but it only works when the sources are few and not spoofing other people’s addresses.

Why is RTBH sometimes an “attacker’s win”?

Destination-based blackholing is a blunt instrument: it throws away good and bad traffic without telling them apart. Routing the victim’s prefix into a black hole makes the service unreachable for everyone — which is exactly what the attacker was after. From the operator’s standpoint it is still often a sensible call: you sacrifice one address to save the links, routers and other services from overload. That is why RTBH is treated as triage and a last line of defense for individual, less critical targets — not as ongoing protection for services that must stay up around the clock. There are further limits on top of that:

• Shared IPs — when many tenants sit behind one address (hosting, CDN, NAT), the black hole takes them all down at once.
• Layer 7 attacks — application floods (HTTP, bots) cannot be handled with “address to Null0” logic; they need filtering that looks at the content of the traffic.
• No visibility — dropped traffic vanishes without a trace unless telemetry was captured beforehand.

How does RTBH differ from BGP FlowSpec and scrubbing?

RTBH, BGP FlowSpec and scrubbing are three levels of precision in DDoS defense, often used together:

• RTBH — works at the level of a whole destination address/prefix (or source with uRPF). An all-or-nothing action: drop everything. Fastest to deploy, but most painful for the victim.
• BGP FlowSpec (RFC 8955) — announces much more detailed rules over BGP: source and destination address, protocol, L4 ports, packet length, fragmentation. It can not only drop but also rate-limit, sample or redirect. That lets it cut the attack traffic itself while legitimate traffic to the same victim stays.
• Scrubbing — redirects traffic (via BGP or DNS) to a cleaning center that inspects packets in depth, throws away the attack and returns clean traffic. The most precise and most expensive; it adds latency and requires rerouting.

A mature strategy usually combines them: FlowSpec or scrubbing for precise, sustained defense, with RTBH as a fast circuit breaker for the moment an attack outgrows the capacity of the links or the scrubbing center.

RTBH at internet exchanges (IXPs) and upstreams

Operators often blackhole not inside their own network but “upstream” — at a transit provider or an internet exchange (IXP). This is signaled with the standardized BGP blackhole community 65535:666 attached to the announced prefix. That way attack traffic is thrown away before it even reaches the victim’s link — that is, before the tightest bottleneck clogs up. RTBH still rests on trust and correct validation: you may only announce your own prefixes, and the blackhole routes themselves must be guarded with the NO_EXPORT tag and egress filters, so they do not leak out and wipe out traffic on a large scale.

Why does RTBH matter for security and network monitoring?

RTBH only makes sense when detection stands behind it. The decision “which prefix to send into the black hole” has to come from telemetry, not guesswork — which is why blackholing is tightly tied to flow monitoring and NDR systems:

• Triggering from flow telemetry — systems analyzing NetFlow/IPFIX/sFlow catch a sudden spike in traffic toward an address, pinpoint the attacked prefix and can inject an RTBH route over BGP on their own.
• Threshold tuning — overly sensitive thresholds lead to self-inflicted outages (blackholing legitimate traffic); knowing the normal traffic level and profiling per host cut down on false alarms.
• Telemetry before the drop — since traffic sent to Null0 disappears, the data needed for post-attack analysis (vector, source distribution, ports) has to be gathered before the rule kicks in. Pairing flow data with logs and SOC events helps here.
• Telling the target from the attacker — telemetry lets you choose between the destination-based variant (fast, but at the victim’s expense) and the source-based one, or a move to FlowSpec/scrubbing when the sources are countable.

Learn more

• Amplification Attack — RTBH can blackhole traffic from amplification attacks to protect the target.
• Internet Peering — RTBH routes can be used across peering links to drop attack traffic upstream.
• Direct Network Flood — RTBH is used to stop direct network floods by discarding traffic toward the victim.