Skip to main content

Remotely Triggered Black Hole Services

Remotely Triggered Black Hole (RTBH) filtering is a self-managed feature that enables you to block unnecessary traffic before it enters Equinix Internet Exchange (IX) protected network. RTBH protects you from Distributed Denial of Service (DDoS) attacks.

  • Equinix provides Black Hole Host with IP address .240 (in APAC), or .253 (in AMER and EMEA) on the IX subnet with mac address 0050.56bb.bbbb.

  • All unicast traffic towards the Black Hole Host is denied at customer facing ports (by mac-address ACL).

For filtering to take effect, the Black Hole announcement must be accepted by other peering partners. Peering participants can accept the prefixes with prefix length = 32 and BGP community 65535:666. Participation in the RTBH feature is optional.

Host Information​

AMER​

MetroIPv4 AddressIPv6 AddressMac Address
Atlanta198.32.182.2532001:504:10::2:4115:253dead:dead:dead
Chicago208:115:137.2532001:504:0::2:4115:253dead:dead:dead
Dallas206.223.118.2532001:504:0::2:4115:253dead:dead:dead
Washington DC206.126.239.2532001:504:0::2:4115:253dead:dead:dead
VA198.32.190.2532001:504:e::2:4115:253dead:dead:dead
Denver198.32.114.2532001:504:0::2:4115:253dead:dead:dead
Houston198.32.135.2532001:504:0::2:4115:253dead:dead:dead
Los Angeles206.223.123.2532001:504:0::2:4115:253dead:dead:dead
Miami198.32.242.2532001:504:0::2:4115:253dead:dead:dead
Miami198.32.114.2532001:504:0::2:4115:253dead:dead:dead
New York198.32.118.2532001:504:f::2:4115:253dead:dead:dead
Seattle198.32.134.2532001:504:12::2:4115:253dead:dead:dead
Silicon Valley206.223.117.2532001:504:0::2:4115:253dead:dead:dead
Portland198.32.176.2532001:504:d::2:4115:253dead:dead:dead
Toronto198.32.181.2532001:504:d::2:4115:253dead:dead:dead
São Paulo64.191.232.2532001:504:0:7:0:2:4115:253dead:dead:dead

APAC​

MetroIPv4 AddressIPv6 AddressMAC Address
Hong Kong119.27.63.2402001:de8:7::2:4115:2400050.56bb.bbbb
Melbourne183.177.61.2402001:de8:6:1:0:2:4115:2400050.56bb.bbbb
Osaka203.190.227.2402001:de8:5:1:0:2:4115:2400050.56bb.bbbb
Perth101.97.43.2402001:de8:6:2:0:2:4115:2400050.56bb.bbbb
Singapore27.111.231.2402001:de8:4::2:4115:2400050.56bb.bbbb
Sydney45.127.175.2402001:de8:6::2:4115:2400050.56bb.bbbb
Tokyo203.190.230.2402001:de8:5::2:4115:2400050.56bb.bbbb

EMEA​

MetroIPv4 AddressIPv6 AddressMAC Address
Amsterdam185.1.112.2532001:7f8:83::2:4115:253dead:dead:dead
Dublin185.1.109.2532001:7f8:c3::2:4115:253dead:dead:dead
Frankfurt185.1.102.2532001:7f8:bd::2:4115:253dead:dead:dead
Geneva192.65.185.2532001:7f8:1c:24a::2:4115:253dead:dead:dead
Helsinki185.1.86.2532001:7f8:af:0::2:4115:253dead:dead:dead
London185.1.104.2532001:7f8:be::2:4115:253dead:dead:dead
Lisbon185.1.116.2532001:7f8:c7::2:4115:253dead:dead:dead
Manchester185.1.101.2532001:7f8:bc::2:4115:253dead:dead:dead
Madrid185.1.22.2532001:7f8:c6::2:4115:253dead:dead:dead
Milan185.1.106.2532001:7f8:c0::2:4115:253dead:dead:dead
Paris195.42.144.2532001:7f8:43:0::2:4115:253dead:dead:dead
Stockholm185.1.107.2532001:7f8:c1::2:4115:253dead:dead:dead
Zurich194.42.48.2532001:7f8:c:8235::2:4115:253dead:dead:dead

Other Supported BGP Communities​

Login required: https://ix.equinix.com/ixp/mlpeCommunityInfo

DefinitionCommunity String
Default Open Policy – Announce to all except to AS1234524115:24115 0:12345
Default Closed Policy – Announce to none except to AS123450:24115 24115:12345
Prepend once to AS1234565501:12345
Prepend twice to AS1234565502:12345
Prepend three times to AS1234565503:12345
Black Hole Traffic65535:666

Distributed Denial of Service Attacks​

Distributed Denial of Service (DDoS) attack causes disruption of services due to unnecessary inbound traffic in your port. RTBH filtering can help to free the port utilization from this unnecessary traffic.

To free the port utilization, the Equinix MLPE route server inserts a BGP route into the network that forces the routers to stop all traffic to the Black Hole Host with predefined IP and MAC addresses.

Before the DDoS Attack Begins​

  1. Establish BGP peering to MLPE route servers through MLPE IX peering subnet. You can announce your prefix 1.1.1.0/24 to MLPE route servers.
  2. MLPE route servers re-announce your prefix to other peering participants.
  3. The next hop to reach 1.1.1.0/24 prefix is .100 which is your peering IP address.

When the DDoS Attack Begins​

  1. There is a DDoS attack traffic towards the server 1.1.1.1.

  2. Your port is flooded with inbound traffic causing service disruption to all production services.

  3. Free the port utilization by stopping traffic to 1.1.1.1.

Mitigating DDoS Risks​

To mitigate the risk of DDoS attacks:

Mitigation Stage 1​

  1. You announce 1.1.1.1/32 with Black Hole BGP community 65535:666.

  2. MLPE route servers modify these prefix announcements (tagged with 65535:666) with next-hop to .240 (in APAC) or .253 (in AMER and EMEA), and re-announce the same prefix to other peering participants.

Mitigation Stage 2​

  1. Peering partners start to resolve next-hop IP address .240 (in APAC) or .253 (in AMER and EMEA) to reach 1.1.1.1.

  2. Black Hole Host replies with an ARP with mac-address 0050.56bb.bbbb.

Mitigation Success​

  1. The attack traffic with next-hop .240 (in APAC) or .253 (in AMER and EMEA) is stopped by Equinix IX switch inbound access list.

  2. The DDoS attack going through your switch port is mitigated.