Source-IP-Origin-AS Filter for BGP Flow Specification
draft-ietf-idr-fsv2-sip-origin-as-filter-00
| Document | Type | Active Internet-Draft (idr WG) | |
|---|---|---|---|
| Authors | Haibo Wang , Aijun Wang , Shunwan Zhuang , Jie Dong , Yang Huang | ||
| Last updated | 2026-11-01 | ||
| Replaces | draft-wang-idr-flowspec-sip-origin-as-filter | ||
| RFC stream | Internet Engineering Task Force (IETF) | ||
| Intended RFC status | (None) | ||
| Formats | |||
| Additional resources | Mailing list discussion | ||
| Stream | WG state | WG Document | |
| Document shepherd | (None) | ||
| IESG | IESG state | I-D Exists | |
| Consensus boilerplate | Unknown | ||
| Telechat date | (None) | ||
| Responsible AD | (None) | ||
| Send notices to | (None) |
draft-ietf-idr-fsv2-sip-origin-as-filter-00
IDR Working Group H. Wang
Internet-Draft Huawei
Intended status: Standards Track A. Wang
Expires: 5 May 2027 China Telecom
S. Zhuang
J. Dong
Y. Huang
Huawei
1 November 2026
Source-IP-Origin-AS Filter for BGP Flow Specification
draft-ietf-idr-fsv2-sip-origin-as-filter-00
Abstract
This document defines an extension to the Border Gateway Protocol
(BGP) Flow Specification Version 2 (FSv2) defined in [draft-ietf-idr-
fsv2-ip-basic] to enable filtering based on the Origin Autonomous
System (AS) of the source IP address. This extension is particularly
useful in mitigating Distributed Denial of Service (DDoS) attacks
where the source IP addresses are dynamic or numerous but belong to a
specific source AS.
Requirements Language
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in BCP
14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
Wang, et al. Expires 5 May 2027 [Page 1]
Internet-Draft Source-IP-Origin-AS Filter November 2026
This Internet-Draft will expire on 5 May 2027.
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Definitions and Acronyms . . . . . . . . . . . . . . . . . . 3
3. Flow Specification Version 2 Encoding for Source-IP-Origin-AS
Filter . . . . . . . . . . . . . . . . . . . . . . . . . 3
3.1. Ordering of Components within Filter Family 1400 . . . . 4
3.2. Operational and Processing Mechanism . . . . . . . . . . 4
4. Use Cases . . . . . . . . . . . . . . . . . . . . . . . . . . 5
5. Security Considerations . . . . . . . . . . . . . . . . . . . 7
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
7. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 7
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 8
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
9.1. Normative References . . . . . . . . . . . . . . . . . . 8
9.2. Informative References . . . . . . . . . . . . . . . . . 8
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9
1. Introduction
BGP [RFC4271] Flow Specification, originally defined in [RFC8955] and
[RFC8956], has evolved to Flow Specification Version 2 (FSv2) as
specified in [I-D.ietf-idr-fsv2-ip-basic]. FSv2 introduces an
extensible, TLV-based filter family architecture with explicit rule
ordering and modular components.
In certain DDoS mitigation scenarios, an operator may need to apply
rate-limiting, redirection, or filtering to traffic sourced from a
particular network (Autonomous System), even when the specific source
IP prefixes within that AS are numerous or rapidly changing.
Manually updating hundreds of prefix-based FlowSpec rules is
inefficient and consumes excessive Hardware Forwarding Information
Wang, et al. Expires 5 May 2027 [Page 2]
Internet-Draft Source-IP-Origin-AS Filter November 2026
Base (FIB) / TCAM resources. This document introduces a new FSv2
component under the Routing Filter Family that allows operators to
use the Source Origin AS as a matching criterion.
2. Definitions and Acronyms
* FSv2: Flow Specification Version 2
* Source-IP-Origin-AS: The origin AS number associated with the
source IP address of a transit packet, determined from the
rightmost AS in the AS_PATH attribute of the active BGP route
matching that source IP.
3. Flow Specification Version 2 Encoding for Source-IP-Origin-AS Filter
This document proposes a new FSv2 component encoded within the
Routing Filter Family (Type 1400). Unlike legacy FSv1 raw byte
streams, FSv2 utilizes explicit TLV formatting.
* Filter Family: 1400 (Routing Filter Family)
* Component Type: 200 (SIP-AS)
Encoding format for the SIP-AS component:
0 1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | Type (200) | Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| <[numeric_op, Source-IP-Origin-AS]+> |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1: Source-IP-Origin-AS Filter
Where:
* Flags (4 bits): Defined in FSv2 specifications.
* Type (12 bits): Set to 200 for SIP-AS.
* Length (16 bits): Length of the value field in octets.
* <[numeric_op, Source-IP-Origin-AS]+>: Contains a list of
{numeric_op, Source-IP-Origin-AS} pairs that are used to match the
Source-IP-Origin-AS.
Wang, et al. Expires 5 May 2027 [Page 3]
Internet-Draft Source-IP-Origin-AS Filter November 2026
- numeric_op: This component uses the Numeric Operator
(numeric_op) described in Section 4.1.1 of
[I-D.ietf-idr-fsv2-ip-basic], Type 200 component values SHOULD
be encoded as 4 octets (numeric_op len=10).
- Source-IP-Origin-AS (32 bits): A 4-octet Autonomous System
Number encoded in network byte order.
3.1. Ordering of Components within Filter Family 1400
As defined in [I-D.ietf-idr-fsv2-ip-basic], rules and components
follow strict ordering principles. The SIP-AS component (Type 200)
within the Routing Filter Family (1400) MUST be evaluated
deterministically according to FSv2 component sequencing rules.
3.2. Operational and Processing Mechanism
Operational and Processing Mechanism
The implementation of Source-IP-Origin-AS filtering relies on a
cross-coupling mechanism between the Unicast BGP Forwarding
Table (FIB) and the Flowspec Packet Inspection Engine. The detailed
processing workflow is defined in the following three steps:
1. Control-Plane Origin AS Derivation and FIB Tagging: When a BGP
speaker receives unicast BGP routes, and those routes are
selected as best paths and installed into the Forwarding
Information Base (FIB), the local system MUST derive and preserve
the associated Origin AS attribute (or a local mapped metadata
tag representing the Origin AS) within the corresponding FIB
entries. The Origin AS for a route is evaluated as follows:
* The Origin AS is defined as the rightmost AS number in the
AS_SEQUENCE segment of the AS_PATH attribute.
* If the AS_PATH ends with an AS_SET, standard evaluation or
local policy applies. For example:
- FIB Entry for Source Prefix A: Tagged with Origin AS 65001
- FIB Entry for Source Prefix B: Tagged with Origin AS 65002
2. Flowspec Rule Installation: When a BGP Flowspec rule containing
the SIP-AS component (Type 200) is received, the system programs
a filtering rule into the forwarding hardware. The match
parameters include both standard RFC 8955/8956 n-tuples (e.g.,
Wang, et al. Expires 5 May 2027 [Page 4]
Internet-Draft Source-IP-Origin-AS Filter November 2026
Destination IP, Source IP, Protocol, Port) and the target Origin
AS value specified in the SIP-AS component (denoted as AS_Rule,
e.g., 65001).
3. Datapath Two-Stage Packet Matching: Upon receiving a data packet:
a. The device evaluates the packet against installed Flowspec
rules.
b. If a candidate rule contains a SIP-AS match condition, the
forwarding engine performs a FIB lookup using the packet's
Source IP address to extract the associated FIB entry's
Origin AS attribute (denoted as AS_FIB). Note: In multi-
homing or multi-path scenarios where multiple valid active
paths exist for the source prefix, AS_FIB is determined based
on the selected forwarding route(s) (e.g., the active best
path or all installed ECMP paths in the FIB).
c. Evaluation:
* If AS_FIB matches AS_Rule (e.g., both are 65001), the SIP-
AS match condition is satisfied, and the configured
Flowspec action (e.g., redirect, drop, rate-limit) is
executed.
* If AS_FIB does not match AS_Rule (e.g., AS_FIB is 65002
while AS_Rule is 65001), the match condition fails, and
packet processing continues to subsequent rules or default
forwarding.
4. Use Cases
This section describes how to use this function in a simple scenario.
Consider the topology shown in Figure 2. Router R2 in AS64597
receives traffic originating from AS64598 destined for IP Prefix 61.
The operator wants to redirect all traffic originating from AS64598
towards Router R3 before forwarding it to IP Prefix 61.
Wang, et al. Expires 5 May 2027 [Page 5]
Internet-Draft Source-IP-Origin-AS Filter November 2026
+---------+
| BGP FS |
| Server |
+----|----+
|
|
+
\
****************\******** IP Prefix 81
* \ * IP Prefix 82
IP Prefix 61 * AS64597\ * IP Prefix 83
* \ * IP Prefix 84
+-------+ * +---+ +--\+ * +-------+
+AS64596+-------+ R1+---------+ R2|------+AS64598+
+-------+ * +-+-+\ +---+ */ +-------+
* \ |\ /
* \ | \ /* IP Prefix 91
* \ | /\* IP Prefix 92
* \ | / \ IP Prefix 93
* \ |/ *\ IP Prefix 94
* \ +-+-+ * \ +-------+
* \-+ R3+------+AS64599+
* +---+ * +-------+
* *
*************************
Figure 2: Traffic Redirection Using FlowSpec
Using the traditional method, ISP AS64597 must inject multiple
"Destination Prefix + Source Prefix" FlowSpec rules into Router R2:
+--------------+--------------+-------------------------+
| Destination | Source Prefix| Action / Next-hop |
| Prefix | | |
+--------------+--------------+-------------------------+
| IP Prefix 61 | IP Prefix 81 | Redirect to R3 |
| IP Prefix 61 | IP Prefix 82 | Redirect to R3 |
| IP Prefix 61 | IP Prefix 83 | Redirect to R3 |
| IP Prefix 61 | IP Prefix 84 | Redirect to R3 |
| ... | ... | ... |
+--------------+--------------+-------------------------+
Figure 3: Traditional FlowSpec Matching
Using the method defined in this draft, ISP AS64597 needs to inject
only a single "Destination Prefix + Source-IP-Origin-AS" FlowSpec
rule:
Wang, et al. Expires 5 May 2027 [Page 6]
Internet-Draft Source-IP-Origin-AS Filter November 2026
+--------------+--------------+-------------------------+
| Destination | Source-IP- | Action / Next-hop |
| Prefix | Origin-AS | |
+--------------+--------------+-------------------------+
| IP Prefix 61 | AS64598 | Redirect to R3 |
+--------------+--------------+-------------------------+
Figure 4: Source-IP-Origin-AS FlowSpec Matching
This method saves significant TCAM space on network elements, reduces
BGP UPDATE messaging load on the control plane, and simplifies
operational management when a source AS advertises numerous dynamic
prefixes.
5. Security Considerations
In addition to the security considerations in
[I-D.ietf-idr-fsv2-ip-basic], operators MUST be aware of routing
inconsistency risks, BGP origin validation via RPKI [RFC6811], and
FSv2 route validation procedures.
6. IANA Considerations
IANA is requested to make the following allocations under the BGP
Flow Specification Version 2 (FSv2) registries defined in
[I-D.ietf-idr-fsv2-ip-basic]:
FSv2 Routing Filter Family Component Types Registry:
+-------------+-----------------------+-------------------+
| Type | Description | Reference |
+-------------+-----------------------+-------------------+
| 200 | SIP-AS (Source-IP-AS) | This document |
+-------------+-----------------------+-------------------+
7. Contributors
The following people made significant contributions to this document:
Tao Qin
Huawei
Email: qintao11@huawei.com
Wang, et al. Expires 5 May 2027 [Page 7]
Internet-Draft Source-IP-Origin-AS Filter November 2026
8. Acknowledgments
The authors would like to thank Susan Hares, Ming Shen, Nan Geng,
Ziqing Cao, Linda Dunbar, Nat Kao, Xiaoying Huang, Ke Ma for their
valuable comments and suggestions.
9. References
9.1. Normative References
[I-D.ietf-idr-fsv2-ip-basic]
Hares, S., Eastlake, D. E., Dong, J., Yadlapalli, C.,
Maduschke, S., and J. Haas, "BGP Flow Specification
Version 2 - for Basic IP", Work in Progress, Internet-
Draft, draft-ietf-idr-fsv2-ip-basic-08, 28 September 2026,
<https://datatracker.ietf.org/doc/html/draft-ietf-idr-
fsv2-ip-basic-08>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC4271] Rekhter, Y., Ed., Li, T., Ed., and S. Hares, Ed., "A
Border Gateway Protocol 4 (BGP-4)", RFC 4271,
DOI 10.17487/RFC4271, January 2006,
<https://www.rfc-editor.org/info/rfc4271>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8955] Loibl, C., Hares, S., Raszuk, R., McPherson, D., and M.
Bacher, "Dissemination of Flow Specification Rules",
RFC 8955, DOI 10.17487/RFC8955, December 2020,
<https://www.rfc-editor.org/info/rfc8955>.
[RFC8956] Loibl, C., Ed., Raszuk, R., Ed., and S. Hares, Ed.,
"Dissemination of Flow Specification Rules for IPv6",
RFC 8956, DOI 10.17487/RFC8956, December 2020,
<https://www.rfc-editor.org/info/rfc8956>.
9.2. Informative References
Wang, et al. Expires 5 May 2027 [Page 8]
Internet-Draft Source-IP-Origin-AS Filter November 2026
[RFC6811] Mohapatra, P., Scudder, J., Ward, D., Bush, R., and R.
Austein, "BGP Prefix Origin Validation", RFC 6811,
DOI 10.17487/RFC6811, January 2013,
<https://www.rfc-editor.org/info/rfc6811>.
Authors' Addresses
Haibo Wang
Huawei
156 Beiqing Road
Beijing
100095
P.R. China
Email: rainsword.wang@huawei.com
Aijun Wang
China Telecom
Beiqijia Town, Changping District
Beijing
102209
P.R. China
Email: wangaj3@chinatelecom.cn
Shunwan Zhuang
Huawei
156 Beiqing Road
Beijing
100095
P.R. China
Email: zhuangshunwan@huawei.com
Jie Dong
Huawei
156 Beiqing Road
Beijing
100095
P.R. China
Email: jie.dong@huawei.com
Wang, et al. Expires 5 May 2027 [Page 9]
Internet-Draft Source-IP-Origin-AS Filter November 2026
Yang Huang
Huawei
156 Beiqing Road
Beijing
100095
P.R. China
Email: yang.huang@huawei.com
Wang, et al. Expires 5 May 2027 [Page 10]