- Access Control
- Attack
- Autonomous System
- Border Gateway Protocol
- Components
- Cybersecurity
- Data Center
- DDoS
Show all 18 topics
Who is Flowspec?
Flowspec is a BGP extension standardized by the IETF that distributes traffic filtering and action rules across routing infrastructure to mitigate network threats and enforce traffic policy.
- Distribution of traffic filtering rules over existing BGP sessions
- Automated DDoS mitigation at network edges and provider boundaries
- Match criteria covering IPv4 and IPv6 prefixes, protocols, ports, and packet attributes
- Traffic actions including discard, rate limiting, redirection, and marking
- Interoperability across multi-vendor routers based on IETF standards
Show more
More About Flowspec
Flowspec, defined in RFC 8955 and its IPv6 companion RFC 8956, extends the Border Gateway Protocol so that network operators can encode filtering criteria as NLRI within BGP updates. Each flow specification contains match components such as destination and source prefixes, IP protocol, port ranges, and packet length, paired with actions that routers apply to matching traffic. Because rules travel over existing BGP sessions, the mechanism scales across large autonomous system boundaries without requiring separate control channels.
In enterprise and service provider environments, Flowspec is positioned primarily as a DDoS mitigation and traffic policy tool. Operators often use it alongside remote-triggered black hole filtering and scrubbing services, allowing an attack signature to be propagated upstream and enforced close to the source. It is also used for access control and selective traffic steering where full route changes would be disruptive. Deployment depends on router support for the SAFI 133 and 134 address families and on careful validation of rules to avoid unintended blocking of legitimate traffic.
Flowspec is often compared with other mitigation approaches in the same solution category. Access control lists configured manually on each device offer granular control but do not scale well and lack centralized distribution. Remote-triggered black holing is simpler but drops all traffic to a target rather than filtering selectively. Flowspec sits between these approaches, providing fine-grained, automated enforcement through a standard routing protocol. Its business significance lies in reducing mitigation time and operational overhead for network teams responsible for availability.
Within the networking and security directory landscape, Flowspec is positioned in network security and service provider routing solution areas. It is relevant to teams managing IP transit, peering, and data center edges, as well as to vendors implementing the standard in routing platforms and mitigation systems. Organizations evaluating it should consider router platform support, rule table capacity, and the operational processes needed to manage rules consistently.
Our description of Flowspec. Updated October 2026.