Blackholing and RTBH: the last-resort weapon against DDoS

Faced with a massive volumetric DDoS attack, there's a brutal but effective countermeasure: blackholing. The idea is simple — rather than letting the attack saturate your entire link (and thus affect all your services), you "drop" the traffic destined for the targeted address before it reaches your network.

The RTBH principle

RTBH (Remote Triggered Black Hole) lets the customer trigger this blackhole remotely, by announcing to its operator, via a dedicated BGP community, the address (usually an IPv4 /32 or an IPv6 /128) to be blackholed. The operator then discards that traffic as close as possible to its borders, where capacity is enormous — long before your access link.

Benefits and the major limitation

The benefit is decisive: you preserve the rest of the infrastructure by sacrificing a single target. It's fast, automatable, and works even against the largest volumes. But you must be clear-eyed about the trade-off: the blackholed IP becomes unreachable itself. In other words, you end the attack by deliberately completing the denial of service on the target — to save everything else.

Blackholing or scrubbing?

Blackholing is a last-resort measure. The ideal solution, when available, is scrubbing: filtering out malicious traffic while letting legitimate traffic through to the target, which therefore stays online. A good strategy combines both: scrubbing as the primary defence, RTBH as a safety valve for extreme cases.

How to use it

• Know your operator's RTBH community in advance and have tested it.
• Target precisely: blackhole the attacked IP, not a whole prefix if possible.
• Automate triggering and withdrawal to react in seconds and restore quickly.

At Connect-IX, our DDoS protection relies first on scrubbing integrated into our network, and we expose the necessary communities (including blackholing) in our list of BGP communities. All of it monitored and controllable in real time.