Detecting DDoS with NetFlow/sFlow and Automatic Mitigation via BGP (RTBH / Flowspec)

Introduction

Volumetric DDoS attacks (UDP flood, NTP/DNS amplification, SYN flood) threaten bandwidth and infrastructure resources in ISPs, data centers and large enterprise networks. This article explains how to detect such attacks with NetFlow and sFlow, define anomaly thresholds, create flow signatures and automate mitigation with BGP-based RTBH or Flowspec (RFC 5575). The target audience is NOC/SOC analysts, BGP/peering engineers and network security architects.

Process flow: Traffic Collection → Anomaly Detection → BGP Trigger → Traffic Blocking

The following logical flow is a practical workflow suitable for production NOC operations:

1. Traffic Collection: NetFlow/sFlow collectors, SPAN/mirror or packet capture collect metrics and sampled headers.
2. Anomaly Detection: Flow data is evaluated with pps/bps thresholds, signature matches and statistical models. IP spoofing checks run as a separate validation step.
3. BGP Trigger: After automated playbook approval, an RTBH or Flowspec announcement is initiated and security checks are applied.
4. Traffic Blocking / Cleansing: Apply RTBH to blackhole a prefix or use Flowspec to drop/redirect targeted traffic; monitor effect and withdraw when appropriate.

Compact process architecture

• Traffic Collection: sFlow collector + NetFlow exporter + SPAN
• Anomaly Detection: real-time flow analysis → threshold & anomaly engine
• BGP Trigger: automated playbook (approved) → RTBH/Flowspec announce
• Traffic Blocking: blackhole or scrubbing redirect

NetFlow vs sFlow: Detection Latency and Sampling Rate Effects

NetFlow and sFlow have different measurement and export behaviors; this directly affects detection latency and accuracy for DDoS detection.

sFlow

• sFlow samples packet headers and sends them immediately. Collector transmission can be sub-second to a few seconds, making sFlow suitable for fast detection of sudden volumetric spikes (1–5s class latencies are achievable).
• Sampling rates are typically 1:100, 1:1000 or higher. High-volume volumetric attacks remain visible under high sampling; low-rate targeted attacks may be lost due to sampling.

NetFlow / IPFIX

• NetFlow exports flows according to flow timeouts (e.g., 30–60s) and exporter intervals. With default settings detection latency can be 30–120 seconds.
• NetFlow/IPFIX supports unsampled (full-flow) or packet-sampling modes; many production environments use sampling for performance. Reducing export intervals (e.g., to 5–15s) improves detection time.

Numerical effect of sampling rates

Example:

• 1 Gbps UDP flood; average packet size 500 bytes → ~250 kpps. With 1:1000 sampling you would still observe ~250 samples/s, which provides a clear anomaly signal.
• However, for a low-volume short SYN flood (e.g. 10 kpps), 1:1000 sampling may not produce enough samples in a short timeframe and detection will be delayed.

Therefore it is best practice to adapt sampling dynamically (e.g., reduce sampling factor for a short period when an anomaly is suspected).

Setting Anomaly Thresholds (pps / bps) and Flow Signatures

A fixed threshold is often unreliable: seasonality, changing top talkers and peering events cause false positives. The following prescriptive approaches are useful.

Thresholding approaches

• Statistical baseline: compute 7–14 day hourly baselines and standard deviations; threshold = mean + k * σ (k typically 3–6).
• Absolute thresholds: for critical services use absolute limits, e.g., 100kpps or 10 Gbps for a given service port determined by SLA.
• Adaptive thresholds: use moving averages and short-term trend analysis; apply lower thresholds on sudden deltas.

Signing malicious traffic

Here, a signature is a set of flow-level characteristics: 5-tuple (src/dst IP, src/dst port, proto), packet-size distribution, TCP flag profiles, pps/bps rates and TTL anomalies. Typical examples:

• UDP amplification: small incoming request to amplifier ports with large responses; source/destination port and response size patterns indicate amplification.
• SYN flood: high SYN ratio, low ACK completion rate, increasing src IP diversity (if spoofed) or concentrated src pools.
• Volumetric UDP flood: high bps and pps to a target with homogeneous packet sizes.

Signatures are used both for detection and for populating Flowspec rules. Ensure signatures remain statistically significant when sampling is applied.

IP Spoofing Detection and Its Role

In amplification and some UDP/SYN attacks, source addresses may be spoofed. Flow data alone cannot always prove spoofing, but several indicators help:

• TTL distribution anomalies: different TTL histograms than normal traffic tend to indicate spoofed or reflective sources.
• Reverse-path (RPF) mismatches: if source prefixes conflict with routing information, suspicion rises.
• Source IP diversity: large distributed spoof pools show different statistical properties than a set of real bots.

Integrating flow analytics with IP spoofing detection modules improves confidence; consider platforms with IP spoofing detection integration.

RTBH vs BGP Flowspec: Differences

RTBH (Remotely Triggered Black Hole) and BGP Flowspec (RFC 5575) are both BGP-based mitigation methods, but they differ in scope and effect.

RTBH (Remote Triggered Black Hole)

• Blackholes traffic at the prefix level: a community or next-hop redirects traffic for a prefix to discard.
• Simple and broad; useful as a fast reflex for NOC operators.
• Side effect: all traffic to that prefix is dropped — collateral damage is high (the target service is also unreachable).

BGP Flowspec (RFC 5575)

• Enables fine-grained filtering at the flow level: match on protocol, ports, src/dst prefixes, tcp flags, packet length and other fields.
• Flowspec can drop or rate-limit specific ports or signatures, or even redirect traffic to scrubbing centers, minimizing collateral damage.
• Flowspec complexity and route churn need management; not all transits or router platforms support Flowspec at scale.

Recommended operational pattern

• Use RTBH as an initial fast response for severe congestion.
• After analysis, apply Flowspec to refine filters and withdraw RTBH.
• Assess control-plane capacity and coordinate with upstream peers before large-scale Flowspec deployment.

Automation, Safety and Operational Controls

Automated BGP triggers are powerful but misconfiguration can be catastrophic. Recommended controls include:

• Two-step approval for automation (automatic detection + human confirmation or confidence-based full automation).
• Restrict announcements to authorized route-targets / communities and enforce policies on BGP to accept only approved Flowspec/RTBH announcements.
• Rate limit how many Flowspec rules can be announced concurrently.
• Comprehensive logging and automatic rollback policies; if impact is not observed, withdraw rules automatically.

NOC Playbook (Step-by-step)

1. Alert: Flow anomaly engine triggers on a pps/bps threshold or signature match.
2. Review: Correlate top talkers, target ports/protocols, TTL/RPF signals and historical traffic.
3. Approve: If service impact is detected, plan a fast RTBH; if the attack is targeted, prepare Flowspec rules.
4. Trigger: The approved playbook executes BGP announcement (RTBH community or Flowspec rule).
5. Monitor: Use collectors and NMS to monitor drop rates, recovery time and customer impact.
6. Tune: Narrow Flowspec filters if applied; withdraw RTBH as soon as safe and monitor normalization.

Real-World Scenarios and Operational Tips

• UDP Amplification: A high bytes-per-packet ratio in inbound traffic is indicative of amplification. Correlate request/response port patterns.
• SYN Flood: High SYN pps with low handshakes suggests SYN attack. Flowspec matches on TCP flags (SYN) are appropriate for drop or rate-limit.
• Distributed Low-Rate Attacks: Many low-rate sources can evade sampled monitoring; temporarily reduce sampling or validate with SPAN-based packet capture.
• Coordinate with Peers: For very large volumetric attacks upstream mitigation or scrubbing is often the most effective option. Align with your peering and service model or scrubbing provider.

Integration with Flowtrion (guidance)

Flowtrion's observability platform provides real-time flow analysis via the Realtime Traffic Analysis module and anomaly detection via the Network Anomaly Detection module. BGP triggers can be integrated using the BGP Management module while spoofing signals benefit from the IP Spoofing Detection module. These integrations are presented as examples of how flow telemetry and BGP controls can be combined operationally.

Summary

NetFlow and sFlow are powerful telemetry sources for volumetric DDoS detection; sampling rates and export latency materially affect detection speed. A pragmatic approach is: use sFlow for fast discovery, NetFlow for structured telemetry, apply RTBH for immediate relief and refine with Flowspec for targeted mitigation. Automation must be secure, auditable and reversible to be safe in production.

For a tailored test plan and a site-specific playbook, request a technical consultation: Request a Flowtrion Technical Consultation.