| Internet-Draft | BGP FSv2 More IP Actions | November 2026 |
| Hares | Expires 5 May 2027 | [Page] |
The BGP flow specification version 2 (FSv2) for Basic IP defines user ordering of filters along with FSv1 IP Filters and FSv2 actions in Extended Communites. This draft suggests a method of encoding user ordered actions in a community attribute in BGP.¶
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶
This Internet-Draft will expire on 5 May 2027.¶
Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved.¶
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶
Version 2 of BGP flow specification (FSv2) is contained in a series of specifications ([I-D.ietf-idr-fsv2-ip-basic]), this document,and individuals specifications for IP Filters, IP actions, and non-IP actions (MPLS, L2, SFC and tunneled IP). This draft defines user-ordered FSv2 actions encoded in a BGP Community Path Attribute and how these actions interwork with the FSv2 actions encoded in Extended Community attributes.¶
The remainder of this Introduction section provides an overview of the FSv2 specifications.¶
Section 2 contains a description of the format and processing of the user ordered actions encoded in the BGP Community Path Attribute in the FSv2 TLV. Section 3 describes Action Components supported by FSv2. Section 4-5 provides information on validation, manageability, and error handling for the FSv2 Actions when the BGP Community Path Attribute is attached to the BGP update message. Sections 6 and 7 contain considerations security and IANA considerations for the FSv2 user ordered actions.¶
BGP Flow Specification version 1 (FSv1) defined in [RFC8955], [RFC8956], and [RFC9117] specifies 2 SAFIs (133, 134) to be used with IPv4 AFI (AFI = 1) and IPv6 AFI (AFI=2).¶
BGP Flow Specification version 2 (FSv2) defined in ([I-D.ietf-idr-fsv2-ip-basic]) a new FSV2 AFI (TBD1) with two SAFIs (TBD2 (Unicast) and TBD3 (VPN)). FSv2 allows for user ordering of filters, dependency between filters, and specifying some component filters as mandatory or optional.¶
FSv1 and FSv2 use different AFI/SAFIs to send flow specification filters. Since BGP route selection is performed per AFI/SAFI, this approach can be termed “ships in the night” based on AFI/SAFI.¶
A complete solution for FSv2 Actions to do the following requires more space than is available in BGP Extended Communities.¶
a user specified-order between the multiple actions associated with a filter, and¶
have dependency between multiple actions.¶
This document defines how to carry user-ordered FSv2 Actions in a BGP Community Path Attribute ([I-D.ietf-idr-wide-bgp-communities]¶
The following types of actions were defined in [I-D.ietf-idr-fsv2-ip-basic] in section 4.9.1¶
AFI - Address Family Identifier¶
AS - Autonomous System¶
BGP Session ephemeral state - state which does not survive the loss of BGP peer session.¶
Configuration state - state which persists across a reboot of software module within a routing system or a reboot of a hardware routing device.¶
CPA - BGP Community Path Attribute¶
DDOs - Distributed Denial of Service¶
Ephemeral state - state which does not survive the reboot of a software module, or a hardware reboot. Ephemeral state can be ephemeral configuration state or operational state.¶
FSv1 - Flow Specification version 1 [RFC8955] [RFC8956]¶
FSv2 - Flow Specification version 2 (this document)¶
FS-EC - Flow Specification Actions in Extended Community¶
FSv2-CPA - FSv2 Actions in BGP Community Path Attribute¶
RIB - Routing Information Base¶
RR - Route Reflector.¶
SAFI – Subsequent Address Family Identifier¶
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals as shown here.¶
The FSv2 actions may be sent in an Extended Community or a Community Path Attribute. User ordering of FSv2 actions requires using the Community Path Attribute. This section defines the FSv2 Container for the BGP community Path attribute.¶
This section defines a FSv2 Action in the BGP Community Path Attribute. The first section reviews the format of the BGP Community Path Attribute. The second section defines the BGP Community Container and the Sub-TLV types allowed within the container. The third section summarizes how the content of FSv2 Container is processed.¶
The BGP Community Path Attribute is defined in: [I-D.ietf-idr-wide-bgp-communities]. The format for the BGP Community Path Attribute is shown in figure 2-1.¶
BGP Community Path attribute common header
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Type = FSv2 (TBD4) | Flags |C|T| Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1
¶
where:¶
This one octet field is anoctet of bits with only two bit that can be set as follows:¶
Editor's note: Should this section be dropped?¶
The FSv2 Action Container allows for grouping of multiple FSv2 actions¶
FSv2 Action TLV
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FSv2 action length |
| (2 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Dependency chain ID (4 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| User order (4 bytes) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Action subTLVs (variable) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2
¶
Where:¶
The FSv2 Action TLVs have the following format:¶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| FSv2 Action Family type | Fsv2 Action Family length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+--+-+
| FSv2 Action Component TLVs (variable) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 3
¶
Where:¶
(2 octets)the following¶
Action Comoponent format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | Action compnent type | Length |
| 4 bits| 12 bits | |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Action component value (variable) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 4
¶
Where FSv2 Action Flags are defined as:¶
Action Flags
0 1 2 3
+---+---+---+---+
| O | R | R | R |
+---+---+---+---+
Figure 5
¶
Where the fields are defined as:¶
FSv2 Community container actions allow user-ordered actions to be associated with a filter-match rule. Each FSv2 rule may have one or more match conditions and one or more associated actions.¶
[I-D.ietf-idr-fsv2-ip-basic] defines FSv2 NLRI operates in ships-in-the-night with the FSv1 NLRI. Flow Specification Extended Community actions can associated with FSv1 NLRI or FSv2 NLRI. Specifications for FSv2 Action are required to specify in the document how actions in the same action category (see 4.9 [I-D.ietf-idr-fsv2-ip-basic]). In practice, FSv1 actions in implementations define by configuration how action in the same category interoperate.¶
The precedence between FS Actions in Extend Community actions and the FSv2 Community Container Actions is that the FSv2 Community Container actions take precedence before the FSv2 Extended Community actions. If local policy alters that precedence between FS Extended Community actions and FSv2 Community container actions, it possible that the actions may have undesired effects due to the ordering of actions.¶
The basic principles for FSv2 Community container actions follows the definitions found in [I-D.ietf-idr-wide-bgp-communities] in section 3 that specify transitivity across Administrative and AS boundaries, Transitivity across AS confederation boundaries. The FSv2 Community Container re-uses the concepts of the FSv2 NLRI (dependency chain, user order, mandatory or optional action components).¶
the specific rules of processing the data within the FSv2 Community container for FSv2 are:¶
Actions are ordered first user-specified ordered carried in the FSv2 Action Container in the Community Attribute. Numerically smaller user-specified order values have better precedence than larger values.¶
For actions with the same user-specified order, the actions then ordered by FSv2 action family type, then FSv2 action component type, and then the rules for each component type.¶
Each FSv2 Action Community Container defines its own rules governing FSv2 actions within the compnent.¶
Editor: The family type helps the default ordering of actions. Is this additional layer useful?¶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Action Continue option (100) | Length (2 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|ACO-dependency | AC-Failure | AC Failure value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-4
¶
where:¶
The order dependency within the Action chain.¶
1 octet byte that determines the action on failure. Actions may succeed or fail and an Action chain must deal with it. The default value stored for an action chain that does not have this action chain is “stop on failure”. AC-Failure types values are:¶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Group Interface set | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Interface group |O I - Flags |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| sequence of interfaces SubTLVs |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Each interface has the format:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|AFI | SAFI | interface adddress |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| interface address (continued) (4 or 16 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-5
¶
where:¶
The Redirect actions in Extended Community are included in Table 2-1. The Redirect traffic component replaces these with a single action component that has ordering rules within the component.¶
Table 2-1
FSv2 Actions supported (Extended Community)
ID FSv2 Description Name FS document
== ============================= ======= ==========
100 Redirect with sub-byte for Redirect
to VRF (2 AS form) RDIPvrf RFC8955
to VRF (IPv4 form) RDIPvrf RFC8955
to VRF (4 AS form) RDIPvrf RFC8955
to IPv4 / copy RDIPv4C RDIP
to IPv6 / copy RDIPv6C RDIP
to VRF (IPv6 form) RDIP6vrf RFC8956
to Indirection ID RDIDC RGID
to SFC Path RDSFP RFC9015
¶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Redirect traffic (100) | Length (2 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| 4-ocet AS |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| AFI | SAFI | Redirect Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| redirect flags | redirect location (variable) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-8
¶
where:¶
The 1-octet redirect type May be one of the following values:¶
Where:¶
0 1 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+ | RES | S-ID |C| +-+-+-+-+-+-+-+-+ Figure 2-9¶
FSv2 redirection functions from the following FSv2 Extended Communities (FSv2-EC):¶
Value field for SFC Classifier CPA
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| sub-type(0x01)| SPI |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| SI | SFT |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-11: The Format of the Flow Specification for SFC
Classifiers Extended Community
¶
where:¶
| Action Coponent | Description | Reference |
|---|---|---|
| 0 | Reserved | [this document] |
| 100 | DSCP mark | [this document] |
| 200 | Mark IPv4 CSID | draft-lin-idr-cats-flowspec-ts |
| 210 | Mark IPv6 CSID | draft-lin-idr-cats-flowspec-ts |
| 210 | Mark IPv6 CSID | draft-lin-idr-cats-flowspec-ts |
| 300 | set Traffic rate limits | [this draft] |
| 400 | sample-copy | [this draft] |
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Action type (0x08) | Length (2 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
|RR | DSCP | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-10
¶
where:¶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Action type | Length (2 octets) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| type of rate limit | length of rate field |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Maximum rate of bytes |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-6
¶
where:¶
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Traffic Sample (400) | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Sample/Copy Value |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-7
¶
where:¶
Interferes with: TBD¶
Value field for Terminate FS Action
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| component type (100) | length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| action upon Termate |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 2-11: Format of the
¶
where:¶
Editor: actions can include logging, checking something else, or perhaps an action chain. Need to add more here.¶
FSv2 actions may associate actions using Extended Communities or the BGP Community Container attribute (FSv2-BCA) with FSv2 NLRIs. All the NLRIs in an UPDATE packet are associate with a FSv2 action found in either one or more FSv2 actions in an Extended Community or a FSv2 BGP Community container.¶
Actions may conflict, duplicate, or complement other actions. FSv2 BGP Community container actions have precedence over the FSv2 actions in an Extended Community.¶
Well-formed syntactically correct actions are logically linked to the filter rule(s) in the NLRI in the BGP Path Attributes. If one action in the ordered list fails, the default procedure is for the action process for this rule to stop and flag the error via system management. By explicit configuration, the action processing may continue after errors.¶
Implementations MAY wish to log the actions taken by FS actions (FSv1 or FSv2).¶
The normal processing of FSv2 actions are by first by user order. Within the same user order, by Action family type in ascending Order where lower numbers have more precedence. Within the same user order and action family type, by action component type where lower numbers have more precedence. Within the same user order, action family type, and action component type, the component must specify precedence.¶
It is important that the operator consider where actions can successfully be implement in computer hardware. For example, if a flow specification action to mark traffic at a particular node cannot be done with the router's hardware, the distribution of flowspec rules with actions may be successful but the FSv2 actions fail. This failure to mark a DSCP may cause other problems.¶
The following error handling rules must be followed by all BGP speakers which support FSv2 Community Attribute:¶
A Malformed BGP Community Container Attribute shall be considered malformed if any action TLVs or the Community container which is malformed.¶
FSv2 Community Path attributes having TLVs which do not follow the FSv2 ordering rules described in this document MUST be considered as malformed by a BGP FSv2 propagator.¶
An Update with a malformed Community Path Attribute shall execute the "treat-as-withdaw" behavior [RFC7606]¶
Note that a BGP speaker MUST NOT TLV type in the FSv2-CPA as an error.¶
Please note that these rules augment the FSv2 rules for NLRI which state:¶
FSv2 NLRI having TLVs which do not have the correct lengths or syntax must be considered MALFORMED.¶
FSv2 NLRIs having TLVs which do not follow the FSv2 ordering rules described in section 4.1 MUST be considered as malformed by a BGP FSv2 propagator.¶
The above two rules prevent any ambiguity that arises from the multiple copies of the same NLRI from multiple BGP FSv2 propagators.¶
A BGP implementation SHOULD treat such malformed NLRIs as ‘Treat-as-withdraw’ [RFC7606]¶
An implementation for a BGP speaker supporting both FSv1 and FSv2 MUST support the error handling for both FSv1 and FSv2.¶
This section complies with [RFC7153].¶
IANA is requested to assign a assign a value from the "BGP Community Container Types" registry in the BGP Parameters group with the value (TBD4) for "Flow Specification Action Container".¶
IANA is requested to create the a new registry for "Flow Specification v2 Action Family Types".¶
Registration Procedures: 0x01-0x3FFF Standards Action.¶
| Type | Description | Reference |
|---|---|---|
| 0 | Reserved | [this document] |
| 1-99 | Unassigned | [this document] |
| 100 | Action Failure | [this document] |
| 101-199 | Unassigned | [this document] |
| 200 | group | [this document] |
| 201-299 | Unassigned | [this document] |
| 300 | redirect | [this document] |
| 301-499 | Unassigned | [this document] |
| 500 | Mark,Merge or Traffic Shape | [this document] |
| 501-699 | Unassigned | [this document] |
| 700 | Flag traffic for sampling | [this document] |
| 701-899 | Unassigned | [this document] |
| 900 | terminate action instructions | [this document] |
| 901-999 | Unassigned | [this document] |
| 1000 | logging | [this document] |
| 1001-4094 | Unassigned | [this document] |
| 4095 | reserved | [this document] |
IANA is requested to create the following entries on a new "Flow Specification v2 Action Component Registry.¶
Registration Procedures: 0x01-0x3FFF Standards Action.¶
Initial values TBD¶
The use of ROA improves on [RFC8955] by checking to see of the route origination. This check can improve the validation sequence for a multiple-AS environment.¶
>The use of BGPSEC [RFC8205] to secure the packet can increase security of BGP flow specification information sent in the packet.¶
The use of the reduced validation within an AS [RFC9117] can provide adequate validation for distribution of flow specification within a single autonomous system for prevention of DDoS.¶
Distribution of flow filters may provide insight into traffic being sent within an AS, but this information should be composite information that does not reveal the traffic patterns of individuals.¶