Blackholing is the general idea behind one of the oldest DDoS mitigation techniques still in active use: instead of filtering traffic based on its contents, you drop it using the routing table itself — advertising a route that sends matching traffic to a discard interface (commonly Null0) instead of its intended destination.
Source-based vs. destination-based
Destination-based blackholing drops all traffic headed to a specific IP — the most common form, and the one used against DDoS attacks, since it stops the flood regardless of where it's coming from. Source-based blackholing drops traffic coming from a specific IP or prefix, useful when the attacking source is well identified and narrow.
Static vs. remotely triggered
A blackhole route can be configured manually and directly on a router — static blackholing, simple but slow to apply under a live attack, and limited to whatever router you can reach and configure yourself. Remotely Triggered Black Hole (RTBH) is the automated form: a special BGP community tag propagates the black-hole instruction to upstream routers — including ones outside your own network, like your transit provider's — without anyone needing router access to those devices directly.
Why it's blunt but still effective
Any form of blackholing drops all traffic to (or from) the affected address — legitimate and malicious alike. For a destination under a large volumetric attack, that's usually still the right trade: a controlled, deliberate outage for one IP is better than an uncontrolled one caused by a saturated shared link.
Where it fits in a DDoS protection stack
Blackholing is the tool of last resort for the attacks big enough that letting traffic through at all is the actual problem — reserved for confirmed, large-scale threats rather than every blocked IP. It sits alongside more targeted techniques (application-layer filtering, granular BGP FlowSpec rules) as the blunt instrument for when precision isn't the point — speed and scale are.
How eHAWK automates it
eHAWK DDoS implements destination-based RTBH: the moment an attacking IP is blocked, a black-hole route is advertised automatically to your configured upstream router, with a live route table view and automatic resync after a restart — see the full RTBH mechanism for the step-by-step detail.