It’s a part of a security response plan, and the more tools you have the better. 1. I don’t think this is the case, but more a question for the guys who deal with this. Definitely subjective. 2. I don’t agree with this statement, but for sure it depends on the infrastructure being attacked, and how resilient it is to attack. 3. This is true. 4. Also true Like I said, it’s a tool in the toolbox available for use. Is it the best option: depends on the situation. David On Tue, Jul 28, 2026 at 2:38 AM Saku Ytti <saku@ytti.fi> wrote:
They David,
Yes. We provide RTBH and I know it's being used. I'm asking if it's desirable.
Reason why it might not be
1) It helps the attacker 2) It prolongs outage to last longer than actual attack 3) It removes observability 4) It is difficult to impossible to do right, for other than self-originated prefixes, i.e. transit provider protecting themselves from their downstream being attacked
Using the BGP community to downgrade the traffic, rather than blackhole, would improve on all these metrics.
On Tue, 28 Jul 2026 at 00:14, David Bass <davidbass570@gmail.com> wrote:
RTBH is absolutely used to thwart DDOS attacks right now in production
at some extremely large, and constantly attacked organizations that I’ve personally seen.
As far as use by attackers…possibly used as well, but haven’t witnessed
this one.
David
On Mon, Jul 27, 2026 at 2:50 AM Saku Ytti via NANOG <
Is there consensus that RTBH is desirable?
Isn't RTBH just aiding the attacker and extending the duration of outage outside the duration of attack? With RTBH implemented, how do we know when the issue subsides? Do we periodically remove RTBH to check?
I think downgrading traffic to scavenger class via a BGP community is superior to RTBH, you are transporting as much as you can, but yielding to best effort. This gives you observability, you know when the issue subsides, as you're still getting the packets, so you can automatically remove the downgrade, the moment the attack subsides. On your end you can push this market traffic to monitor box, scrubber box, through ACL, null0 or whatever is locally prudent right now.
On Mon, 27 Jul 2026 at 10:41, James Bensley via NANOG <nanog@lists.nanog.org> wrote:
Dear Community,
RTBH is not as effective as it could be, for various reason, just a
few include:
* Not all networks support RTBH. * Networks that do support RTBH implement it differently to each
other.
* There is no one place where one can easily find the info for how to use RTBH with a given network. * Operators have different ideas about how / when / where / why someone should / shouldn't use RTBH.
To this end, below is the first of two surveys. This first one is quantitative and captures how networks have implemented RTBH and provides (1) a public repository which anyone can use to look-up the RTBH details for their peers/upstreams, and (2) an insight into the (mis-)alignment of RTBH implementations across the industry.
Please take the time to fill out the short survey for your own network (even if you don't support RTBH!), and if you can, please fill it out for other networks where you know how they have implemented RTBH (e.g.,
(^ No login required)
The data ends up in this public repository (you can of course make a
nanog@lists.nanog.org> wrote: peers you use RTBH with): https://docs.google.com/forms/d/e/1FAIpQLScg2Bvr_14onOtZRdoK2SNd0kCHFtqsdw-e... pull request directly if you want): https://remotely-triggered-black-hole.github.io/rtbh/
The second survey will be qualitative, to gather information from the
industry community on why you do / don't support RTBH, when do you use it, how do you think the routing should be secured, etc.
The long term goal is to use the data from both surveys as input in
to a community effort to improve RTBH alignment across the industry and improve it's effectiveness for all (e.g. maybe produce a new BCOP for implementing RTBH, or usage guidelines for blackholing, or maybe a new RFC is required to secure the filtering; regardless, the first step is to gather data about the status quo and review that data to get a baseline of where we are at today).
Any questions, please let me know, and thank you for your time and
help, it is appreciated.
With kind regards, James_______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/LOWUU7RH...
-- ++ytti _______________________________________________ NANOG mailing list
https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/ITDOCC6N...
-- ++ytti