Re: RTBH Support Across the Industry

Is there consensus that RTBH is desirable?

Isn't RTBH just aiding the attacker and extending the duration of
outage outside the duration of attack? With RTBH implemented, how do
we know when the issue subsides? Do we periodically remove RTBH to
check?

I think downgrading traffic to scavenger class via a BGP community is
superior to RTBH, you are transporting as much as you can, but
yielding to best effort. This gives you observability, you know when
the issue subsides, as you're still getting the packets, so you can
automatically remove the downgrade, the moment the attack subsides.
On your end you can push this market traffic to monitor box, scrubber
box, through ACL, null0 or whatever is locally prudent right now.


On Mon, 27 Jul 2026 at 10:41, James Bensley via NANOG
<[email protected]> wrote:
>
> Dear Community,
>
> RTBH is not as effective as it could be, for various reason, just a few include:
>
> * Not all networks support RTBH.
> * Networks that do support RTBH implement it differently to each other.
> * There is no one place where one can easily find the info for how to use RTBH with a given network.
> * Operators have different ideas about how / when / where / why someone should / shouldn't use RTBH.
>
> To this end, below is the first of two surveys. This first one is quantitative and captures how networks have implemented RTBH and provides (1) a public repository which anyone can use to look-up the RTBH details for their peers/upstreams, and (2) an insight into the (mis-)alignment of RTBH implementations across the industry.
>
> Please take the time to fill out the short survey for your own network (even if you don't support RTBH!), and if you can, please fill it out for other networks where you know how they have implemented RTBH (e.g., peers you use RTBH with): https://docs.google.com/forms/d/e/1FAIpQLScg2Bvr_14onOtZRdoK2SNd0kCHFtqsdw-elsO5miUAO-3zzg/viewform
>
> (^ No login required)
>
> The data ends up in this public repository (you can of course make a pull request directly if you want): https://remotely-triggered-black-hole.github.io/rtbh/
>
> The second survey will be qualitative, to gather information from the industry community on why you do / don't support RTBH, when do you use it, how do you think the routing should be secured, etc.
>
> The long term goal is to use the data from both surveys as input in to a community effort to improve RTBH alignment across the industry and improve it's effectiveness for all (e.g. maybe produce a new BCOP for implementing RTBH, or usage guidelines for blackholing, or maybe a new RFC is required to secure the filtering; regardless, the first step is to gather data about the status quo and review that data to get a baseline of where we are at today).
>
> Any questions, please let me know, and thank you for your time and help, it is appreciated.
>
> With kind regards,
> James_______________________________________________
> NANOG mailing list
> https://lists.nanog.org/archives/list/[email protected]/message/LOWUU7RHOKTYKVGWRHNXQJ3GSJYN3HLE/



-- 
  ++ytti
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/[email protected]/message/ITDOCC6N5VELZ56F6ILVZODZSUWH3TNE/