How it works
When an address in your network is under attack, you announce a route for that single address (for example a /32) with a special BGP community. Peer1IX and participating networks then drop all traffic destined for it at their edge.
Why it helps
The attack traffic never reaches your links, so other customers and services continue normally.
The trade-off
All traffic to the blackholed address is dropped — including legitimate users. The target is offline for the duration. RTBH protects the rest of the network at the expense of the victim.
When to use it
- The attack threatens to saturate shared links.
- The target is less critical than the rest of the network.
- Scrubbing is not available or not yet engaged.
Make it routine
Pre-configure blackhole communities, document the procedure and test it. During an attack, it should take minutes.
Then move to finer tools
Once the network is stable, consider flowspec or scrubbing to restore service to the target.
