<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#44546A;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#44546A'>Wow, 4 replies for fastnetmon, thanks Ryan, Vincente, Job and Kushal<o:p></o:p></span></p><p class=MsoNormal><span style='color:#44546A'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#44546A'>I’ll look into it<o:p></o:p></span></p><p class=MsoNormal><span style='color:#44546A'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#44546A'>-Aaron<o:p></o:p></span></p><p class=MsoNormal><span style='color:#44546A'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> NANOG [mailto:nanog-bounces@nanog.org] <b>On Behalf Of </b>Aaron Gould<br><b>Sent:</b> Thursday, August 30, 2018 2:53 PM<br><b>To:</b> Nanog@nanog.org<br><b>Subject:</b> automatic rtbh trigger using flow data <o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi, does anyone know how to use flow data to trigger a rtbh (remotely triggered blackhole) route using bgp ? …I’m thinking we could use quagga or a script of some sort to interact with a router to advertise to bgp the /32 host route of the victim under attack.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Btw, I already have nfsen running and we receive real-time alters of various types of attacks, high volume, high ports, etc… and then we telnet into a cisco trigger router and drop a few lines of code into it and then bgp does the rest within seconds, the upstream providers learn of this route via communities and they rtbh it in their cloud, BUT, I would like my alerts to do this automatically… that would be very nice. Any guidance would be appreciated.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Aaron<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>