Attacks and Mitigations

Attacks

Security → Attacks lists every detected attack, active ones first, with its target, direction, type, peak and what was done about it. Attacks marked observe are baseline anomalies in observe mode: recorded and (if you route them) notified, but never mitigated, and left out of the red strip above every page.

The attack page

• State in the title, with Withdraw and Extend for its mitigations, and the target’s display name when it has one.
• Figures: the peak against the limit, packets, the number of sources, the interface it arrives on, the mitigation, and how long it lasted.
• The chart: the target’s traffic from a minute before the start, the limit dashed, and marks for detection, each announcement and the end. With both-sides sampling, a second line shows the rate delivered past the router.
• Fingerprint: protocols, ports, packet sizes and TCP flags, and the FlowSpec rule Heimnull would build from it.
• Sources and source networks: the top source addresses, ASes and countries. For a remote source, the abuse contact from its registry, for a report.
• Steps: what happened when, and what each router actually received (read back from the BGP session).
• Sample flows: while the attack is active, the target’s recent raw flows; afterward, a sample of up to 500 flow records kept with the attack.

See Detection for how attacks are detected, typed and ended.

Mitigations

Security → Mitigations lists blackholes and FlowSpec rules: active, dry run, withdrawn, expired, refused and failed. Each mitigation’s page shows its rule or route, its lifecycle, why it was refused if it was, and what each BGP session actually received.

Mitigate an address

Mitigate an address (operators and admins) blackholes an address or announces a FlowSpec rule by hand:

1. Enter the address, the direction and a reason (required, and recorded in the audit log).
2. For FlowSpec, choose the rule (protocols, ports, packet lengths, SYN-only, fragments) and the action. They default to the hostgroup’s.
3. Preview shows exactly what each session will receive: the route or rules, next hop, communities and local preference.
4. Turn on Dry run to record the mitigation without announcing anything.

A manual mitigation goes through the same safety checks as an automatic one, and survives restarts.

Withdraw and extend

Operators can withdraw a mitigation at once, or extend it. Every change is in the audit log.

Emergency withdraw-all

Withdraw all on the Mitigations page (operators and admins, with a reason) withdraws every announced route within seconds and refuses new mitigations. A strip above every page says it’s in force. Only an admin can Resume mitigation, and resuming announces nothing by itself: new attacks are mitigated as usual from then on. Both steps are recorded in the audit log.

Mitigation also needs the trial or a paid license. In Free mode, the Mitigations and BGP pages say why nothing is announced, and Mitigate an address is hidden.