Combination of Remote Triggered Source and Destination Blackhole Filtering

A remote triggered combined destination and source IP address black hole filtering apparatus comprising:

• a remote triggered destination address black hole filter (RTDBHF) unit having a first border gateway protocol community value (BGPCV) to identify the RTDBHF unit, the RTDBHF unit comprising:
• one or more processors;
• a first route information listing, wherein the route information listing includes a routing table or forwarding information base;
• a non-transitory computer readable medium containing machine-readable instructions, which, when read by the one or more processors, causes the one or more processors to:
• receive a first advertisement having a first modified next hop address for a destination address of network traffic;
• receive a first advertised BGPCV from the first advertisement;
• and
• overwrite a first next hop address of the destination address with the first modified next hop address in the first route information listing, wherein the first next hop address is overwritten only if the first advertised BGPCV matches the first BGPCV and wherein the first next hop address is not overwritten if the first advertised BGPCV does not match the BGPCV;
• a remote triggered source address black hole filter (RTSBHF) unit having a second BGPCV to identify the RTSBHF unit, the BHF unit comprising:
• one or more processors;
• a second route information listing, wherein the second route information listing includes a routing table or forwarding information base;
• a non-transitory computer readable medium containing machine-readable instructions, which, when read by the one or more processors, causes the one or more processors to:
• receive a second advertisement having a second modified next hop address for a source address of network traffic;
• receive a second advertised BGPCV from the second advertisement;
• and
• overwrite a second next hop address of the source address with the second modified next hop address in the second route information listing, wherein the second next hop address is overwritten only if the second advertised BGPCV matches the second BGPCV, and wherein the second next hop address is not overwritten if the second advertised BGPCV does not match the second BGPCV;
• wherein one of the RTDBHF unit or the RTSBHF unit is configured to forward filtered traffic to one of the first modified next hop address or second modified next hop address, the filtered traffic comprising only network traffic that addressed to the destination address or from the source address;
• wherein a sinkhole tunnel is configured to communicatively couple the RTDBHF unit to the RTSBHF unit;
• wherein one of the one of the RTDBHF unit or the RTSBHF unit is configured to transport the filtered traffic via the sinkhole;
• wherein the other of the RTDBHF unit or the RTSBHF unit is configured to receive the filtered traffic from the sinkhole;
• and
• wherein the other of the RTDBHF unit or the RTSBHF unit is configured to forward attach traffic to a discard interface, attack traffic being filtered traffic that is both addressed to the destination address and addressed from the source address.

A system for combined remote triggered destination and source IP address black hole filtering comprising:

• a core network in communication with an external network, and a subnetwork, the core network comprising:
• an internal border gateway protocol router, comprising:
• one or more first processors;
• and
• a first non-transitory computer readable medium containing machine readable instructions, which, when read by the one or more first processors, cause the internal border gateway protocol router to:
• generate a customized internal border gateway protocol advertisement, wherein the advertisement includes a first modified next hop address for a destination address of network traffic, and a second modified next hop address for a source address of network traffic;
• a first set of one or more remote triggered destination address black hole filtering (RTDBHF) routers, each RTDBHF router having a respective first border gateway protocol community value (BGPCV) to identify the particular RTDBHF router and comprising:
• one or more second processors;
• and
• a second non-transitory computer readable medium containing machine readable instructions, which, when read by the one or more first processors, cause the particular RTDBHF router to:
• receive a first advertisement having a first modified next hop address for a destination address of network traffic;
• receive a first advertised BGPCV from the first advertisement;
• overwrite a first next hop address of the destination address with the first modified next hop address in a first route information listing, wherein the first route information listing includes a routing table or forwarding information base, wherein the first next hop address is overwritten only if the first advertised BGPCV matches the first BGPCV and wherein the next hop address is not overwritten if the first advertised BGPCV does not match the first BGPCV;
• and
• a second set of one or more remote triggered source address black hole filtering (RTSBHF) routers, each RTSBHF router having a respective second BGPCV to identify the particular RTSBHF router and comprising:
• one or more third processors;
• and
• a third non-transitory computer readable medium containing machine-readable instructions, which, when read by the one or more third processors, cause the particular RTSBHF router to:
• receive a second advertisement having a second modified next hop address for a source address of network traffic;
• receive a second advertised BGPCV from the second advertisement;
• and
• overwrite a second next hop address of the source address with the second modified next hop address in a second route information listing, wherein the second route information listing includes a routing table or forwarding information base, wherein the second next hop address is overwritten only if the second advertised BGPCV matches the second BGPCV, and wherein the second next hop address is not overwritten if the second BGPCV does not match the second BGPCV;
• wherein a particular RTDBHF router of the first set of the first set or a particular RTSBHF router of the second set is configured to forward filtered traffic to one of the first modified next hop address or second modified next hop address, the filtered traffic comprising only network traffic that addressed to the destination address or from the source address;
• wherein a sinkhole tunnel is configured to communicatively couple the particular RTDBHF router to the particular RTSBHF router;
• wherein one of the one of the particular RTDBHF router or the RTSBHF router is configured to transport the filtered traffic via the sinkhole;
• wherein the other of the particular RTDBHF router or the particular RTSBHF router is configured to receive the filtered traffic from the sinkhole;
• and
• wherein the other of the particular RTDBHF router or the particular RTSBHF router is configured to forward attach traffic to a discard interface, attack traffic being filtered traffic that is both addressed to the destination address and addressed from the source address.