Peer1IX
Internet Exchange
Services

Interconnection

Internet ExchangeMicro PoPsEdge Data Centers

Network Services

Data Center to Data CenterVirtual Connectivity HubData Center to CloudCloud to CloudPeer1ix Cloud RouterPeer1ix Virtual EdgeNAT GatewayPeer1ix PortVirtual Cross Connect

Security Services

DDoS ProtectionPeer1ix FWaaSIPsec Tunnel

Cloud Interconnect

Cloudflare Network Interconnect
Locations
Network toolsAll-in-One Network ReportBGP Looking GlassRPKI ValidatorBGP Security & Hijack CheckIP WHOISAS WHOISBGP Route ExplorerASN InsightsBGP Hijacks & Route LeaksInternet Outage TrackerCountry Internet InsightsTop Domains RankingDNS LookupSubnet CalculatorWhat Is My IP
BlogAboutContact Get connected

BGP Flowspec: Surgical DDoS Filtering

· 1 min read · Peer1IX Team

BGP Flowspec: Surgical DDoS Filtering

Flowspec lets you filter attack traffic by pattern rather than dropping everything. How it works and how to use it safely.

Beyond blackholing

Blackholing drops all traffic to the target. Flowspec is more precise: it drops or rate-limits only traffic matching an attack signature.

What a rule looks like

A flowspec rule can match combinations such as destination address, protocol, source or destination port, and packet length — for example, "UDP from source port 123 to this /32", typical of NTP amplification.

Distribution

Rules are distributed via BGP to edge routers, which install them as filters.

Benefits

  • The target stays reachable for legitimate users.
  • Filtering happens at the edge, before links saturate.

Safety

Flowspec is powerful. Validate rules carefully, limit which networks can send rules, and set expiry so temporary rules do not linger.

In practice

Peer1IX DDoS Protection can apply flowspec at the fabric edge in coordination with your team.

flowspecDDoS filteringBGP

Keep reading

Security

DDoS Protection for ISPs: Protecting Subscribers and the Network

ISPs face attacks aimed at their subscribers, their infrastructure and their customers' businesses. A layered approach to protection.

 Security

VXC Security: Who Can See My Traffic?

Virtual cross connects are private, but it is worth understanding exactly what that means — and when to add encryption.

 Security

Multi-Cloud Security Policies on a Shared Fabric

Each cloud has its own security tools. A shared fabric lets you apply consistent controls to traffic moving between them.