bgp nlri flowspec

Pre-Alpha. This page describes behavior that may change.

BGP FlowSpec (RFC 8955, RFC 8956) for IPv4 and IPv6, plus the VPN variants. Carries traffic filtering rules instead of routing information. All four families are decoded, encoded, and originated through the plugin NLRI pipeline, not the legacy core path.

Category

Address families.

Configuration

plugin {
    internal nlri-flowspec { use bgp-nlri-flowspec }
}

bgp {
    peer upstream-flowspec {
        family {
            ipv4/flow     { prefix { maximum 1000; } }
            ipv6/flow     { prefix { maximum 1000; } }
            ipv4/flow-vpn { prefix { maximum 1000; } }
            ipv6/flow-vpn { prefix { maximum 1000; } }
        }
    }
}

Behaviour

The plugin encodes and decodes all four FlowSpec families: IPv4 (AFI 1 / SAFI 133), IPv6 (AFI 2 / SAFI 133), and the two VPN variants (SAFI 134). Rules carry a set of match conditions (source prefix, destination prefix, protocol, port ranges, TCP flags, ICMP types) and traffic actions (drop, rate-limit, redirect to VRF). The rate-limit:N:bytes action (RFC 8955) specifies a byte-per-second cap. The ExaBGP bridge version is 6.0.0.

FlowSpec rules are what you advertise to upstream providers for remote-triggered blackholing and traffic scrubbing. The FlowSpec injection blueprint has a worked example.

Plugin pipeline

The bgp-nlri-flowspec plugin registers four in-process callbacks: InProcessNLRIDecoder, InProcessNLRIEncoder, InProcessRouteEncoder, and InProcessConfigRouteParser. Decode, encode, route origination, and config parsing all live in the plugin, so the RIB, filter chain, and central config code need no FlowSpec-specific knowledge. JSON output is rendered through the attribute JSON registry with ExaBGP-compatible key ordering. The plugin ships its own YANG schema for the FlowSpec match-and-action grammar.

Interactions

• Supports both encode and decode for all four families.
• Interacts with the BGP Role plugin for per-peer FlowSpec trust boundaries.

Source

main/internal/component/bgp/plugins/nlri/flowspec/

See also

• Address Families for the full family list.
• FlowSpec injection for a worked example.
• Plugins for the plugin catalogue.

Adapted from the flowspec plugin source code (RFC 8955 / RFC 8956).