Both RTBH and BGP FlowSpec use BGP to signal upstream routers during a DDoS attack — but they solve the problem at very different levels of precision. Knowing which one a given attack calls for is the difference between a clean mitigation and unnecessary collateral damage.

How RTBH works

Remotely Triggered Black Hole (RTBH) advertises a route for a specific destination IP with its next-hop set to a discard address, so upstream routers drop everything headed there — the whole destination, indiscriminately. Simple, fast, and supported on essentially every router that speaks BGP.

How FlowSpec works

BGP Flow Specification (RFC 5575 and successors) propagates much richer filtering rules over BGP — match on source/destination address, port, protocol, packet length, TCP flags, and more — and specify an action (drop, rate-limit, redirect) applied only to traffic matching that specific rule. Instead of black-holing an entire IP, FlowSpec can drop just the UDP traffic on a specific port that's actually part of the attack, while everything else to that IP continues normally.

The trade-off: precision vs. simplicity

  • RTBH is blunt but universal — it works on essentially any router, requires no packet-level rule authoring, and applies in seconds. The cost is that legitimate traffic to the same IP is blocked too.
  • FlowSpec is surgical — legitimate traffic to the same destination can keep flowing while only the matching attack traffic is dropped. The cost is that it requires FlowSpec support on both ends of the BGP session (not universal across all routers and providers) and correctly authored rules — a wrong rule can do more damage than the attack.

When operators reach for which

RTBH remains the default for large, confirmed volumetric floods where speed matters more than precision, and for any environment where upstream FlowSpec support can't be guaranteed. FlowSpec earns its complexity when an attack has a distinguishing signature narrow enough to filter without losing legitimate traffic — and when both the operator's routers and the upstream provider support it. Many operators use both: RTBH as the universal fallback, FlowSpec where the infrastructure and the attack signature both allow for something more targeted.

Where eHAWK stands today

eHAWK DDoS automates RTBH — the technique with the broadest router support and the fastest time-to-mitigation for the large, volumetric attacks that most threaten shared transit capacity, with configurable AS number, peer AS, neighbor IP, next-hop and community string, plus a live route table and effectiveness reporting.