service information

Blackholing guide

Blackholing is typically used to fight massive DDoS attacks which congest the physical connection between DE-CIX and a customer router. A detailed description of how Blackholing works at DE-CIX is available here.

Besides signaling a blackhole via direct peering, you can signal blackholes via the route servers at all exchanges except certain partner locations.

Blackholing via direct peering

You have to set the corresponding next-hop manually (please see table below) when signaling a blackhole in a direct peering session.
Please also ask your peers to accept up to /32 for IPv4 and up to /128 for IPv6 from you to allow the service to work correctly.

Blackholing via the route servers

If you want to blackhole a certain IP prefix by using the conventional or Blackholing route servers, there are two ways of achieving this:

  • The BGP announcement carrying the IP prefix that should be blackholed is marked with the BLACKHOLE BGP Community (65535:666). This is the recommended way as it makes handling a lot easier.
    or
  • The BGP announcement carrying the IP prefix that should be blackholed contains as next-hop a pre-defined Blackhole IP address. The table below lists the IPv4 and IPv6 Blackhole IP addresses for the different DE-CIX IXPs.
Internet ExchangeBlackhole next-hop IPv4 addressBlackhole next-hop IPv6 addressBGP BLACKHOLE community
Frankfurt 80.81.193.66 2001:7f8::1a27:66:95

65535:666

 

ASEAN103.162.254.662001:df6:480::94f9:b:dead
Athens (SEECIX) 185.1.172.66 2001:7f8:f5::de1a:b:dead
Barcelona185.1.119.662001:7f8:10a::e1ca:b:dead
Chicago149.112.11.662001:504:102::f528:b:dead
Copenhagen185.0.4.662001:7f8:139::3:1359:b:dead
Dallas206.53.202.662001:504:61::f423:42:1
Dubai (UAE-IX)185.1.8.662001:7f8:73::efbe:42:1
Dusseldorf185.1.170.662001:7f8:9e::de3a:42:1
Esbjerg185.0.17.662001:7f8:143::3:e21:b:dead
Hamburg185.1.210.662001:7f8:3d::a8f4:42:1
Helsinki185.0.5.662001:7f8:13a::3:1358:b:dead
Istanbul185.1.48.662001:7f8:3f::50eb:42:1
Jakarta103.159.71.1262001:df5:7880::2614:b:dead
Johor Bahru103.119.235.662403:4ac0:2::953e:b:dead
Karachi (PIE Karachi)58.181.127.662001:df2:b940:0:2:2413:b:dead
Kinshasa (ACIX)196.60.92.662001:43ff:6000::93a7:b:dead
Kristiansand185.0.6.662001:7f8:13b::3:1341:b:dead
Kuala Lumpur103.119.234.662403:4ac0:1::9532:b:dead
Lagos (AF-CIX)196.49.90.662001:43f8:1690::93a1:b:dead
Leipzig185.1.245.662001:7f8:df:0:3:1f77:b:dead
Lisbon185.1.131.662001:7f8:d5::aad1:42:1
Madrid185.1.192.662001:7f8:a0::be99:42:1
Malaysia103.119.232.662403:4ac0::951f:b:dead
Marseille185.1.47.662001:7f8:36::50ed:42:1
Munich185.1.208.662001:7f8:44::b87c:42:1
New York206.82.104.662001:504:36::f63a:63:34
Nordics185.0.8.662001:7f8:13e::3:12c2:b:dead
Oslo185.0.7.662001:7f8:13c::3:1336:b:dead
Palermo185.1.46.662001:7f8:32::61fb:42:1
Penang (PIX)103.10.57.662001:deb:c001:0:2:7de:b:dead
Phoenix149.112.27.662001:504:116::6:1bca:b:dead
Richmond206.53.137.662001:504:44::6:218:b:dead
Ruhr region (Ruhr-CIX)185.1.197.662001:7f8:106::e223:b:dead
Singapore103.159.71.662001:df5:7880::2614:b:dead

Please do not set the NO-EXPORT or NO-ADVERTISE community on the BGP announcements marked as blackhole as this tells the route servers not to re-distribute this announcement. The route servers will add NO_EXPORT automatically.

Configuration examples of how to setup a BGP session to the route servers can be found in the route server guides.