FlowSpec

FlowSpec (BGP Flow Specification) is an extension to the BGP routing protocol that distributes detailed traffic filtering rules across the network, together with the action to apply to matching traffic. Normally, to block some traffic you have to enter the rules (ACLs) on each router by hand, one by one. FlowSpec works differently: an operator defines a flow once, and that definition spreads on its own through BGP to every router. A rule can match traffic by addresses, protocol, ports, or packet length, and the action can discard it, rate-limit it, redirect it, or mark it. FlowSpec is described in the standards documents RFC 8955 (for IPv4) and RFC 8956 (for IPv6), which replaced the earlier RFC 5575.

What is FlowSpec?

FlowSpec adds a new kind of information to BGP. Normally BGP advertises routes to prefixes (groups of addresses). Here, instead of a route, you advertise a description of a traffic flow — in BGP terms this is an NLRI (Network Layer Reachability Information). The rules are carried by Multiprotocol BGP (MP-BGP) in address family AFI 1 with number SAFI 133 for IPv4 unicast (and SAFI 134 for VPNv4).

As a result, you advertise a rule once from a single place (a controller), and it reaches every edge router that acts as a FlowSpec client automatically. Each router stores it in hardware (usually in TCAM memory), so filtering happens fast, at the hardware level.

The main use of FlowSpec is precise mitigation of DoS and DDoS attacks (attempts to flood a service with traffic so it stops working). It lets you pinpoint and handle exactly the malicious traffic — for example, a specific UDP port involved in an attack — without cutting off the entire targeted address.

How does FlowSpec work? What a rule is made of

A single rule in RFC 8955 can have up to twelve match criteria. A packet matches the rule only when it meets all of the present criteria at once (a logical AND). The available criteria are:

• Type 1 / 2 — destination and source address (prefix).
• Type 3 — IP protocol number (e.g. TCP, UDP, ICMP).
• Type 4 — source or destination port; the criterion matches if the specified value corresponds to either one.
• Type 5 — destination port only.
• Type 6 — source port only.
• Type 7 / 8 — ICMP type and code.
• Type 9 — TCP flags (e.g. SYN, ACK).
• Type 10 — total packet length.
• Type 11 — DSCP field (traffic class marking).
• Type 12 — fragmentation bits (DF, IsF, FF, LF).

Ports, lengths, and protocol numbers can be written with comparisons (=, >, < and their combinations). This lets a rule cover, say, a range of ports or a list of values, not just a single number.

What actions does FlowSpec support?

The action — what the router should do with matching traffic — is carried by so-called BGP extended communities (Traffic Filtering Action Extended Communities). The most important ones are:

• traffic-rate-bytes (0x8006) — rate-limit in bytes per second. A value of 0 means discard all matching traffic (drop), i.e., a plain block.
• traffic-rate-packets (0x800c) — rate-limit in packets per second (added in RFC 8955).
• traffic-action (0x8007) — the T (terminal) and S (sample) bits, which let you sample and log matching traffic.
• rt-redirect (0x8008 / 0x8108 / 0x8208) — redirect traffic into a separate VRF instance, e.g., to a traffic scrubbing center or for analysis.
• traffic-marking (0x8009) — change the DSCP value in matching packets.

In practice this gives three main ways to respond: drop, rate-limit, and redirect (for further processing). That is more than a simple all-or-nothing choice.

FlowSpec rule validation

Since a rule spreads across the network on its own, someone could try to advertise a rule that blocks someone else’s traffic. To prevent this, RFC 8955 defines a procedure for checking (validating) received rules. A rule is considered valid when, among other things:

1. it contains a destination address (prefix) criterion;
2. the sender of the rule is also the originator of the best unicast route to that address;
3. there are no more-specific unicast routes from a different autonomous system (AS) that conflict with the rule’s prefix.

In short: a rule for a given destination can essentially be advertised only by the neighbor that knows the best route to it. This matters especially when rules are exchanged between operators (across different ASes).

How does FlowSpec differ from RTBH?

RTBH (Remotely Triggered Black Hole) is an older technique. For the attacked address, you advertise a route with an agreed marker (often :666) that steers all traffic to that address into null — that is, nowhere. This protects the infrastructure from overload, but has a serious drawback: it cuts off legitimate traffic too. The targeted host becomes completely unreachable, so in practice it does the attacker’s job for them.

FlowSpec acts far more precisely:

• it filters on several criteria (address, protocol, ports, packet length), not just on the whole destination address;
• it can rate-limit or redirect traffic, not only discard it;
• it blocks only traffic matching the attack pattern, while the rest of the service keeps running.

There is also a destination-based RTBH implemented via FlowSpec and an S/RTBH variant (filtering by source address). FlowSpec, however, offers the most control — at the cost of more complex configuration.

Why does FlowSpec matter for security and network monitoring?

FlowSpec closes the loop: detect an attack, respond to it. Detection systems based on flow telemetry (NetFlow, IPFIX, sFlow) see an anomaly — unusual traffic volume, suspicious ports, or the signature of a known attack. A controller (such as a DDoS detector) then advertises the matching FlowSpec rule, which immediately reaches the edge routers and mitigates the attack right at the network ingress.

For SOC, NDR, and network teams, what counts is that:

• the response is distributed and fast — a single rule spreads over BGP to the entire router fleet;
• the sample/log and redirect actions let you not only drop traffic but observe and analyze it (e.g., after redirecting it to scrubbing);
• rules are precise and reversible — they can be narrowed, and withdrawn once the attack is over, limiting the impact on legitimate traffic.

You do, however, need to keep the risks in mind. A badly written rule can cut off production traffic by mistake. TCAM memory on routers is limited, so you cannot add rules without end. Exchanging rules between operators requires trust and prior agreements — many networks still do not accept FlowSpec rules from their customers.

Learn more

• Amplification Attack — FlowSpec can help filter traffic patterns used in amplification attacks.
• What is a DDoS attack and how to defend against it in 2026 — FlowSpec is a mitigation method used to block abusive traffic during DDoS attacks.
• Microsegmentation — FlowSpec complements microsegmentation by controlling traffic at the network edge.
• Advanced methods of protection against DDoS attacks in companies — FlowSpec is one advanced technique used for automated DDoS traffic filtering.
• North-South vs East-West Traffic — FlowSpec is mainly relevant for controlling north-south traffic entering or leaving a network.
• Secure Access Service Edge (SASE) — FlowSpec can support SASE by enforcing traffic filtering close to the network edge.
• Internet Peering — FlowSpec can be applied at peering points to block malicious transit traffic.
• Direct Network Flood — FlowSpec can help mitigate direct network floods by dropping targeted packets.