What is RTBH?

RTBH (Remotely Triggered Black Hole) is a technique where a network uses BGP to ask its upstream providers to drop all traffic to an address under attack.

When a DDoS attack fills the links between you and your providers, filtering on your own router is too late. With RTBH you announce the attacked address, usually as a /32 such as 198.51.100.25/32 from your 198.51.100.0/24, tagged with the well-known BLACKHOLE community 65535:666 defined in RFC 7999. Your provider's import policy recognises the community, accepts this host route (normally it would refuse anything longer than a /24), checks it falls within your registered address space, and rewrites the next hop to a discard address that routes to a null interface. It also adds NO_EXPORT so the /32 never spreads further. From then on, the provider's edge routers throw away traffic to that address before it ever reaches your links. Many providers also support their own blackhole communities, so check what each one documents.

RTBH is a blunt tool: the attacked host goes completely offline, so in effect you finish the attacker's job for that one address to keep the rest of your network and your other customers up. It is meant to be quick and temporary; withdraw the route as soon as the attack ends. A common mistake is adding NO_EXPORT yourself, which stops the route from being sent to the very eBGP provider you are trying to reach. Another is an export filter that blocks all /32s, or a community match that never fires, so the announcement silently never leaves. A variant called source-based RTBH (RFC 5635) drops traffic from given sources instead, using uRPF. Scrubbing services are the gentler alternative. The BGP communities, prepending and RTBH lesson triggers a real blackhole and shows both of those mistakes.