Remote triggered blackhole, or RTBH, means we drop traffic to one attacked IP at the network edge on purpose. The goal is to stop a volumetric flood from filling your link and hurting neighbors on the same prefix. It is not a WAF, and it does not inspect HTTP. Ask us about the path before you need it at 3 a.m., so we already know how to trigger it cleanly.
What RTBH is for
You use RTBH when one IPv4 address is taking so much volume that the NIC or uplink is saturated. Edge routers learn a community or a discard next-hop for that single address and throw the flood away upstream. The attacked IP goes dark, including SSH and the site on that address. That is intentional. The rest of the prefix keeps working, which is the whole point of punching one host instead of a whole block.
Volume attacks and application-layer attacks still need different tools. RTBH helps when the pipe is full. Slow HTTP, xmlrpc abuse, or a heavy search URL belong with app fixes, a WAF, rate limits, and caches. Blackholing an address because PHP workers are busy only takes the shop offline for a plugin problem. Null-routing a full /24 because one IP is hit is collateral damage. Ask first, then target the one address.
What has to be ready
We need to know which IP is under fire, which prefix it sits in, and whether you have a spare address. Two IPv4 addresses on a VPS is a common survival pattern for this hour: blackhole the flooded one, point DNS at the quiet one, and keep serving. If the flood follows DNS to the new address, you are back to an edge decision. If you only have one address, RTBH is a choice between a dark site and risk to neighbors. We will tell you what we can actually do on your setup.
How to open the ticket
If SSH is already dead and the NIC is pegged, send the attacked IP, the time in UTC, and that you cannot get in. Do not reboot as a first step. Do not try to iptables a multi-gigabit flood on a smaller NIC; the pipe is already full before your host firewall sees a fair fight. Write the attacked IP down clearly so we do not guess.
If you announce the prefix on your own ASN, RTBH may be a community you send on that session when we have documented it with you. If we announce the space, we trigger the blackhole from our side. A host firewall still will not un-fill the uplink. Use the edge for pure volume, fix the application for layer-7 pain, and treat RTBH as the blunt edge tool for one address when nothing else will clear the path.
Tagged
Was this article helpful?
Be the first to rate this article.
