August 13, 2026

Remote triggered blackhole without the drama

A remote triggered blackhole is a BGP advertisement that tells your edge — and sometimes your transits — to discard a destination. It is the grown-up version of unplugging the victim so the rest of the building keeps the lights. It is also how juniors disappear a /24 they meant to save.

I only RTBH a host or a /32 I can name, with a ticket, a start time, and a person who will withdraw it. The trigger community is documented. The looking-glass check after the announce is mandatory: open the looking glass and confirm the blackhole community is what you think it is, not a leak of the discard to a peer who never agreed.

When remote triggered blackhole is the right tool

Volumetric junk at a single VIP. A host that is on fire and not in an anycast pool. A customer who asked you to discard them. It is not for “this /22 looks noisy.” It is not for a prefix you do not originate. Confirm origin with a BGP prefix lookup before you advertise a discard for space you do not speak for.

route 203.0.113.88/32
  community 65535:666
  next-hop 192.0.2.1    /* discard */

What RTBH will not do

It will not keep the application up. It will not distinguish good clients from bad. Flowspec and an upstream scrubber are how you stay online. RTBH is how you stop the invoice from becoming a museum piece. RFC 7999 is the BLACKHOLE community; read it once so you do not invent a private number everyone else already uses.

Write the withdraw time in the ticket before you announce. Future you is the person you are protecting.