Summary

  • BGP Flow Specification distributes packet-match rules and filtering actions; seeing the route proves a control-plane state, not a forwarding outcome.
  • External rules normally depend on unicast-route validation, and must be revalidated when the best-match unicast route changes.
  • Several rules or actions may overlap or conflict, while IPv6 parsing and hardware limits can prevent an apparently valid match from being enforced.
  • Close mitigation only with evidence that joins the exact NLRI and actions to device programming, counters, sampled packets, victim traffic and safe withdrawal.

Imagine a DDoS controller originating a rule for one destination and transport port. Seconds later, the rule is visible on the route reflector and on three edge control planes. The incident dashboard turns green. Yet one high-volume ingress link continues forwarding the target traffic because its line card could not compile the upper-layer match. The BGP evidence was real. The conclusion drawn from it was not.

This is a hypothetical operating trace, not an allegation about a vendor or network. Its lesson is that a distributed instruction and an executed filter belong to different evidence layers.

What the route actually carries

RFC 8955 encodes a Flow Specification as an n-tuple in BGP NLRI. Components can describe destination and source prefixes, protocol, ports, TCP flags, packet length, DSCP and fragments. A packet matches only when it satisfies the intersection of every component present. That makes the decoded expression—not a dashboard label—the first item to preserve.

The accompanying BGP Extended Communities carry actions. The standard set includes rate limits in bytes or packets, sampling, route-target redirect and traffic marking. The default for a matching rule is ordinary acceptance. A rate of zero conventionally means discard. A route that arrives without the action an operator expected may therefore be installed without producing the intended drop.

More than one Flow Specification can match the same traffic. RFC 8955 defines ordering independently of BGP arrival order, but multiple actions can still interfere. If conflicting actions reach forwarding selection, the implementation decides which are used. Propagation can remain perfectly healthy while local behavior differs by platform or policy.

Validation is a moving dependency

An external Flow Specification is not normally accepted on syntax alone. Without an explicit override, it must contain a destination prefix, its originator must match the originator of the best-match unicast route, and no more-specific unicast route from a different neighboring AS may be captured. A configuration can relax the destination-prefix requirement, so the validation policy itself is evidence.

The unicast route can change independently. RFC 8955 requires revalidation when it does. A rule feasible at 10:01 can become infeasible after a routing change, even though the original BGP announcement remains in a collector. Conversely, an internal BGP receiver may rely on validation already performed elsewhere. The record must name where validation happened and which unicast state supported it.

RFC 8956 extends the mechanism to IPv6, using AFI 2 with SAFI 133 or 134 and IPv6-specific components. Its validation requires a destination-prefix offset of zero. It also identifies a harder data-plane boundary: malformed or oversized IPv6 header chains and hardware limitations can make upper-layer matches impossible to enforce. Control-plane acceptance cannot erase that limitation.

The outcome needs packet evidence

RFC 8955 recommends packet-header logging and per-rule match counters. Those observations are not decorative. They connect the selected rule to traffic. A useful incident view shows which target devices and interfaces programmed the rule, whether hardware rejected or approximated any component, what precedence and action survived compilation, and how counters changed.

Then measure the outcome outside the rule itself: traffic reaching the victim, legitimate traffic lost, redirect capacity, latency, and the effect of withdrawal. A rising discard counter can coexist with an unchanged attack if the rule matches the wrong aggregate. A falling victim rate can coexist with excessive collateral damage. Neither condition is visible from the FlowSpec route alone.

Sources