Hostgroups

Configure → Hostgroups. A hostgroup is a set of your prefixes with its own detection limits, alerts and mitigation. An address belongs to the hostgroup with the most specific prefix covering it; a prefix belongs to one group only. Admins edit hostgroups; everyone can read them.

General

Setting	What it does
Name, Comment	For you
Prefixes	One per line

Limits

Each limit can be on or off, inbound and outbound, per host and for the whole group (the sum over every host in it, which catches carpet bombing). Rates accept k, M, G and T (2G, 300k).

Metric	Measures
bps, pps, fps	Bits, packets and flow records per second
tcp_bps, tcp_pps, udp_bps, udp_pps, icmp_bps, icmp_pps, other_bps, other_pps	Per protocol
syn_pps	TCP packets with SYN and without ACK
frag_bps, frag_pps	IP fragments
amp_bps, amp_pps	UDP from the amplification source ports (Settings → Detection)

Defaults per host:

Metric	Inbound	Outbound
Bits	2 Gbit/s	1 Gbit/s
Packets	300 kpps	200 kpps
SYN	50 kpps	20 kpps
Fragments	20 kpps	10 kpps
Amplification	500 Mbit/s	200 Mbit/s
ICMP	50 kpps	20 kpps

Every other metric, and every group limit, starts off.

Tuning preview

While you edit limits, the preview replays them over the per-minute peaks Heimnull recorded in the last 1 to 90 days, and shows how many attacks and distinct hosts each limit would have triggered, with a timeline, beside the saved settings. A limit below the peak-recording floor (Settings → Detection) is flagged, since hosts below the floor were never recorded.

Trigger

Setting	Default	What it does
Consecutive evaluations	3	Seconds a limit must be exceeded in a row
Hysteresis	0.7	The attack ends when every triggered metric is below limit × this…
End after (s)	30	…for this many seconds
Cooldown (s)	60	A new trigger within this time re-opens the previous attack

Flex rules

Up to 16 extra limits per hostgroup on a slice of traffic: a direction, a metric (bits, packets or flows) and a limit, for traffic matching any of protocols, source and destination ports, remote ASes, remote countries, a packet size range, fragments, and TCP flags set or clear (letters FSRPAUEC). A flex rule counts per host in the group, and shows in attack triggers as flex:<name>.

Baseline triggers

Setting	Default	What it does
Enabled	On	Baseline triggers for this group. The global switch in Settings → Detection overrides it
Mode	Observe	Observe: record and (if routed) notify as attack_observed, never mitigate. Active: act like a limit
Multiplier	3	Trigger above the learned baseline × this
Floors	See below	Per metric, inbound, outbound and for the group: never trigger below this

Default floors: per host inbound 100 Mbit/s, 20 kpps, 5 kpps of SYN and 50 Mbit/s of amplification; outbound 100 Mbit/s and 20 kpps; for the group, 1 Gbit/s and 200 kpps. The Baseline tab draws the group’s recorded peaks against its learned band. See Detection.

Actions

Separately for inbound attacks (on your hosts) and outbound attacks (from your hosts):

Action	What happens
Notify (default)	Record and notify
None	Record only
Blackhole	Also announce a blackhole route for the target
FlowSpec	Also announce FlowSpec rules built from the attack’s fingerprint
FlowSpec, escalating to a blackhole	FlowSpec first; a blackhole too if the attack stays above a rate for a while

Mitigation settings

Setting	Default	What it does
Ban duration (s)	900	How long a mitigation lasts
Maximum duration (s)	86400	Cap for escalation and extensions
Withdraw	At expiry	At expiry, or as soon as the attack ends
Extend while the attack continues	On	At expiry, extend by the ban duration if the attack is still active
Escalate repeat offenders	On	Double the duration for each new mitigation of the same address within 24 hours
Dry run (announce nothing)	Off	Record what would be announced, without announcing
Blackhole communities	Empty	Override the BGP page’s default communities for this group
Local preference	0	0 uses the BGP page’s default
Blackhole the whole hostgroup prefix on carpet-bombing attacks	Off	Announce the group’s prefix instead of one host, no shorter than Shortest IPv4 prefix (/24) and Shortest IPv6 prefix (/48). Takes everything in it offline
Preview for an address		Shows exactly what each BGP session would receive for an address in this group

FlowSpec

Setting	Default	What it does
Action	Discard	Discard matching traffic, or rate limit it
Rate limit (bits/s)		For rate limiting. Sent as bytes per second, as RFC 8955 requires
Redirect to route target		Optional, AS:N (2-byte AS): send matching traffic into a VRF, such as a scrubbing path
Mark DSCP		Optional, 0 to 63
Allow FlowSpec rules on the whole hostgroup prefix for carpet-bombing attacks	Off	Same minimum prefix lengths as above

Escalation

For FlowSpec, escalating to a blackhole:

Setting	Default	What it does
Escalate after (s)	60	Add a blackhole when the attack stays above the rate this long (minimum 10)
Escalate above (bits/s)	0	0: any rate while the attack lasts
Also escalate when a transit link is congested	Off	Add a blackhole when a Transit or Peering link the attack arrives on stays full. The address goes offline, so the link stays usable for everyone else
Link congested at (%)	95	Of the interface’s subscribed rate, else its port speed
For (s)	15	How long the link must stay that full

For inbound attacks, escalation measures the rate delivered past the router, which needs the exporter sampled on both sides. Without it, FlowSpec always escalates, and the page says so. See Mitigation.