BGP Flow Spec for DDoS mitigation - BalticNOG 2025

BGP FlowSpec for DDoS mitigation – real-world lessons from production networks At BalticNOG 2025, FastNetMon Co-Founder Pavel Odintsov presents a practical deep dive into BGP FlowSpec (RFC 5575) for DDoS mitigation. The session compares BGP blackholing (RTBH) with BGP FlowSpec and shows how FlowSpec is used during live DDoS attacks—from detection and investigation to mitigation. The talk covers FlowSpec filtering and actions, and highlights real-world limitations and vendor-specific behaviour across Juniper, Cisco ASR 9000, Huawei, Arista EOS, Extreme Networks, Nokia, BIRD, and GoBGP, including challenges with NetFlow and IPFIX visibility. A must-watch session for network operators, ISPs, and security engineers dealing with DDoS in production. Read our full event recap and get the presentation slides here: https://fastnetmon.com/2025/09/30/eve... #DDoS #BGP #FlowSpec #RFC5575 #NetworkSecurity #ISP #NetFlow #IPFIX #FastNetMon