BGP FlowSpec

FlowSpec is a standardized method for using BGP to distribute traffic flow specifications (flow routes) throughout a network. A flow route carries a description of a flow in terms of packet header fields such as source IP address, destination IP address, or TCP/UDP port number and indicates (through a community attribute) an action to take on packets matching the flow. The primary application for FlowSpec is DDoS mitigation.

FlowSpec is supported for both IPv4 and IPv6. To exchange IPv4 FlowSpec routes with a BGP peer the flow-ipv4 keyword must be part of the family command that applies to the session and to exchange IPv6 FlowSpec routes with a BGP peer flow-ipv6 must be present in the family configuration.

The NLRI of an IPv4 flow route can contain one or more of the subcomponents shown in Table: Subcomponents of IPv4 flow route NLRI.

Table: Subcomponents of IPv4 flow route NLRI
Subcomponent name [type]	Value encoding	SR OS support
Destination IPv4 Prefix [1]	Prefix length, prefix	Yes
Source IPv4 Prefix [2]	Prefix length, prefix	Yes
IP Protocol [3]	One or more (operator, value) pairs	Partial. No support for multiple values other than ‟TCP or UDP”.
Port [4]^{^¹}	One or more (operator, value) pairs	Yes
Destination Port [5]	One or more (operator, value) pairs	Yes
Source Port [6]	One or more (operator, value) pairs	Yes
ICMP Type [7]	One or more (operator, value) pairs	Partial. Only a single value is supported.
ICMP Code [8]	One or more (operator, value) pairs	Partial. Only a single value is supported.
TCP Flags [9] ^{^²}	One or more (operator, bitmask) pairs	Yes
Packet Length [10]	One or more (operator, value) pairs	Yes
DSCP [11]	One or more (operator, value) pairs	Partial. Only a single value is supported.
Fragment [12]	One or more (operator, bitmask) pairs	Partial. No support for matching DF bit, first-fragment or last-fragment.

The NLRI of an IPv6 flow route can contain one or more of the subcomponents shown in Table: Subcomponents of IPv6 flow route NLRI.

Table: Subcomponents of IPv6 flow route NLRI
Subcomponent name [type]	Value encoding	SR OS support
Destination IPv6 Prefix [1]	Prefix length, prefix offset, prefix	Partial. No support for prefix offset.
Source IPv6 Prefix [2]	Prefix length, prefix offset, prefix	Partial. No support for prefix offset.
Next Header [3]	One or more (operator, value) pairs	Partial. Only a single value supported.
Port [4]^{^¹}	One or more (operator, value) pairs	Yes
Destination Port [5]	One or more (operator, value) pairs	Yes
Source Port [6]	One or more (operator, value) pairs	Yes
ICMP Type [7]	One or more (operator, value) pairs	Partial. Only a single value is supported.
ICMP Code [8]	One or more (operator, value) pairs	Partial. Only a single value is supported.
TCP Flags [9]	One or more (operator, bitmask) pairs	Partial. Only SYN and ACK flags can be matched.
Packet Length [10]	One or more (operator, value) pairs	Yes
Traffic Class [11]	One or more (operator, value) pairs	Partial. Only a single value is supported.
Fragment [11]	One or more (operator, bitmask) pairs	Partial. No support for matching Last Fragment.
Flow Label [13]	One or more (operator, value) pairs	Partial. Only a single value is supported.

Table: IPv4 FlowSpec actions summarizes the actions that may be associated with IPv4 flow-spec routes. Table: IPv6 FlowSpec actions summarizes the actions that may be associated with IPv6 flow-spec routes.

Table: IPv4 FlowSpec actions
Action	Encoding	SR OS support
rate limit	Extended community type 0x8006	Yes
sample/log	Extended community type 0x8007 S-bit	Yes
next entry	Extended community type 0x8007 T-bit	—
Redirect to VRF	Extended community type 0x8008	Yes
Mark traffic class	Extended community type 0x8009	Yes
Redirect to IPv4	Extended community type 0x010c	Yes
Redirect to IPv6	Extended community type 0x000c	—
Redirect to LSP	Extended community type 0x0900	Partial, only support for ID-type 0x00 (localized ID)

Table: IPv6 FlowSpec actions
Action	Encoding	SR OS support
rate limit	Extended community type 0x8006	Yes
sample/log	Extended community type 0x8007 S-bit	Yes
next entry	Extended community type 0x8007 T-bit	—
Redirect to VRF	Extended community type 0x8008	Yes
Mark traffic class	Extended community type 0x8009	Yes
Redirect to IPv4	Extended community type 0x010c	—
Redirect to IPv6	Extended community type 0x000c	Yes
Redirect to LSP	Extended community type 0x0900	Partial, only support for ID-type 0x00 (localized ID)