RTBH / L3-L4 MITIGATION
Blackhole triggered by your own announcement. No phone calls.
RTBH lets you survive a volumetric attack without losing the whole link: announce the target address with a blackhole community and traffic to it is dropped before it reaches your port.
202831:666:0 drops here, at every upstream and at exchange points. 202831:911:0 drops at transits only, so the address stays reachable here and over IXes. For IPv6 we accept prefixes down to /128 within your ROAs.
No calls and no tickets — the blackhole is triggered by your own announcement. A post-incident review is mandatory.
- 202831:666:0 — dropped here, at every upstream and at IXes
- Up to /128 within your ROA prefixes (IPv6)
- Isolate the target, not the whole uplink
- A written post-incident review is mandatory
OPEN POLICY
We peer with anyone holding an ASN and an interest in fewer hops. No NDA required for that.
- A registered ASN with correct IRR objects (RADb / RIPE)
- Signed ROAs for every announced prefix
- A max-prefix limit agreed during turn-up
- A working NOC contact that answers
- No transit announcements through our session without prior agreement
| COMMUNITY | ACTION |
|---|---|
| 202831:666:0 | BLACKHOLE — drop here, at every upstream and IX (/48–/128 within your ROAs) |
| 202831:911:0 | BLACKHOLE — transits only, stays reachable here and at IXes |
| 202831:100:N | PREPEND ×N (1–3) to transits |
| 202831:101:N | PREPEND ×N (1–3) to IXes and peers |
| 202831:300:0 | DO NOT ANNOUNCE to transits (IXes and peers only) |
| 202831:301:0 | DO NOT ANNOUNCE to IXes and peers (transits only) |
| 202831:2:ASN | INFO — set by us: route learned from customer ASN |
Large communities only (RFC 8092): AS202831 is a 32-bit ASN, classic 202831:666 cannot exist. Transits are GlobalNet and HE; IXes are DATA-IX, Piter-IX and Cloudflare. By default customer routes go to GlobalNet and DATA-IX with a ×2 prepend. Honoured on customer IPv6 tunnel sessions.
- BIRD 3.x on the MSK and FRA cores
- prefix-list or origin + RPKI ROV, invalids dropped
- MD5 on request, BFD where it earns its keep
- MP-BGP, IPv4 and IPv6 in one session or separately
- flow accounting and alerts on session state change
WHAT WE REFUSE TO ACCEPT
The old site had a list of surnames here. We replaced it with a list of prefixes — more useful, and unlike politics it is actually enforced at the edge.
GET IN TOUCH
Three addresses and one messenger. There is no eight-item phone menu.
Send your AS number, the bandwidth you want and the site — that is enough for a first reply.