Reference
BGP
Heimnull's BGP speaker, its sessions to your routers, blackhole communities and next hops, and what it announces.
Configure → BGP sets up Heimnull’s BGP speaker (GoBGP, built into the container), which announces blackhole routes and FlowSpec rules to your routers. Everyone can read it; admins change it.
Heimnull never accepts routes from its peers: every route a router sends is rejected (the page counts them). Configure your routers to send it nothing. Origin ASes come from the flow records and Heimnull’s datasets, not from BGP.
Local speaker and blackhole defaults
Section titled “Local speaker and blackhole defaults”| Setting | What it does |
|---|---|
| Local AS | Heimnull’s AS. 0 turns BGP off, and port 179 closes |
| Router ID | Heimnull’s BGP identifier, one for all sessions |
| Listen port | 179 |
| Blackhole communities | The communities every blackhole carries, unless a hostgroup sets its own. Standard (64512:666), large (64512:0:666) and extended (rt:64512:666) communities work, and blackhole for RFC 7999’s 65535:666, which we recommend. A blackhole without a community is refused |
| Local preference | For iBGP sessions |
| MED | Optional |
Changing the local AS, router ID or listen port restarts the BGP speaker: every session drops and comes back. The page warns before it does.
Sessions
Section titled “Sessions”| Setting | What it does |
|---|---|
| Name, Description | For you |
| Peer address | The router |
| Remote AS | The router’s AS: the same as yours for iBGP |
| Local address | Optional: the address Heimnull uses for this session |
| Hold time, Keepalive | Timers in seconds |
| MD5 password | Optional, stored encrypted |
| IPv4, IPv6 | The unicast families, for blackholes |
| IPv4 FlowSpec, IPv6 FlowSpec | The FlowSpec families |
| Announce mitigations to this session | Send blackholes, and FlowSpec rules on the families above. Off, the session receives nothing |
| IPv4 next hop, IPv6 next hop | The next hop of blackhole routes on this session, usually an address the router routes to discard. Empty uses the session’s local address |
| Enabled |
A session change applies at once. An unchanged save, or a Heimnull restart, never resets a session.
For each session the page shows its state, uptime, last error and flaps, the families both sides agreed on, and the routes the router sent (all rejected). If the router didn’t offer a family you enabled (FlowSpec, typically), the page flags it: nothing of that family is sent until the router enables it (on Junos, family inet flow and family inet6 flow).
What’s announced
Section titled “What’s announced”- Blackholes: the attacked address as a /32 or /128, with the communities, local preference (iBGP only) and MED, and each session’s own next hop.
- FlowSpec: rules built from the attack’s fingerprint, with their actions as extended communities. See Mitigation.
After announcing, Heimnull reads back what each session actually sent and keeps it with the mitigation, so the mitigation’s page and its notification show exactly what each router received, or why it didn’t (the session was down, or the router lacks the family).
Recent events lists session changes, and any correction the reconciliation made. See Mitigation.