In this recipe, we'll develop a capability to rapidly deploy packet filters to all devices in our network, making use of BGP to transport the specification of the packet filter rules to all the routers in our network. The capability, defined formally in IETF RFC 5575 and often informally called FlowSpec, is particularly useful in defending large networks against distributed DOS attacks.
It's important to note that these are not full-on session-based firewall rules, but rather a specification of packet-level characteristics that can be applied to incoming traffic in order to determine if special handling is needed. In our case, we'll take a specification of packets based on the following fields in the IP header and we will apply the discard action.
- Source address
- Destination address
- Source TCP/UDP port
- Destination TCP/UDP port...
