Filtering attacks with Flowspec
A null route stops an attack by throwing away everything to the target — the attacker wins by taking you offline. Flowspec is the scalpel to that hammer: it drops only the attack traffic and lets the rest through.
When traffic to one of your addresses is being flooded, the blunt defence is a null route: discard everything headed for that IP. It protects the rest of the network, but the target is now down — which is what the attacker wanted. Flowspec does better.
A firewall rule that travels by BGP
Flowspec distributes fine-grained filtering rules through BGP itself. Instead of “drop everything to this IP”, you can say “drop UDP to this IP on this port above this rate” — and have it applied at the network edge, before it reaches your server at all.
What you can match on
- Source and destination address
- Protocol and port — so you can drop the attack vector and keep the service
- Packet length and rate — so you rate-limit rather than block outright
The point: the service stays up
A volumetric UDP flood against a web server can be filtered with a rule that drops the junk UDP while leaving TCP 443 flowing. Legitimate users never notice; the attack is dropped at the edge. That is the whole advantage over null-routing — precision instead of self-inflicted downtime.
It works with our scrubbing
Flowspec is one tool alongside our always-on filtering — see how DDoS filtering works here. For a known, specific attack signature it is fast and surgical; for broad volumetric floods, upstream scrubbing does the heavy lifting. They complement each other.
Using it with us
If you run BGP with us, we can accept Flowspec rules from you within agreed limits, or apply them on your behalf during an incident. Tell us the signature — addresses, protocol, ports — and we drop it at the edge. See also what you can do about DDoS.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base