AS286 selective BlackHole (formerly known as extended regional BlackHole)
v20201104

Fading away ...

AS286/KPN International was taken over by AS3257/GTT in December 2019. AS286 will be integrated into / migrated to 3257 and fade away. Therefore some of the information found on these pages might be outdated / obsolete.

Standard introduction

This document only applies to the KPN International IP backbone AS286.

The hereby described communities may be adjusted, altered and updated any time. Even our processes cover updates to documentation, there's no guarantee, that it's always up-to-date. In case of doubt, transit customers should contact our NOC and peers should contact peering@as286.net.

A description of standard communities for AS286 can be found here AS286-communities.html.
A general description on routing policies of AS286 can be found here AS286-routing-policy.html.

selective BlackHole "sBH" / extended regional BH "erBH" (transit customers only)

With KPN's standard blackhole community 286:66 (or IETF's 65535:666), all traffic towards the tagged prefix is blackholed / discarded everywhere (even on the PE the customer is connected to), which basically takes the host "offline".

KPN's sBH/erBH communities allow you to blackhole traffic towards a tagged prefix on just some part of KPN's network. As quite often attacks originate from a specific region or do enter KPN's network at only limited places, sBH/erBH communities might help you to keep a certain level of connectivity while still blocking (D)DOS attacks against a certain IP.

A simple example: A customer connected in The Netherlands is being (D)DOS and the (D)DOS traffic enters KPN's network in the US. With sBH/erBH communities you can "instruct" KPN's network to only blackhole traffic towards the target in the US, while European traffic is still forwarded.
Taking this a step further: if above attack enters KPN's network in just two of the US locations, you can even enable normal traffic forwarding for all the other KPN PoPs in the US.

Notes:

sBH / erBH - trigger (transit customers only)

You must at least tag your prefix with one of the following triggers. If not, your announcement will be just treated like every other announcements.

(Just to document 286:6666, which will show up on sBH/erBH announced routes: 286:6666 is "all except PE"; 286:666[1-4] are just aliases to 286:6666 + WL whatever is needed.)

sBH / erBH - whitelisting (transit customers only)

Attach one or more of the following communities to whitelist (WL) PEs in PoPs, cities countries and continents, which would blackhole traffic based on your chosen trigger or to just explicitly list PoPs you want to blackhole (BL).
Again: whitelisting takes precendence over blackholing!