DDoS detection and mitigation by sending FlowSpec upstream
The RFCs this use case requires, each declared by the Use cases row of its own summary. RFCs it lists as optional follow in their own table and never enter its figures.
Use case: FlowSpec Injection
MUST, MUST NOT, REQUIRED, SHALL and SHALL NOT rows of the walked RFCs that a recorded test break proves.
MAY, NOT RECOMMENDED, OPTIONAL, RECOMMENDED, SHOULD and SHOULD NOT rows, counted the same way.
Attainable mandatory rows under current classifications, over the unchanged total.
Attainable optional rows under current classifications, over the unchanged total.
RFCs with no valid extraction sign-off: their rows count in neither figure.
A profile is complete only when it requires at least one RFC and none of them is unwalked.
Mandatory ceiling: 290 of 343 (84.5%); excluded: Optional feature not offered (classification can be revisited): 11 of 343 (3.2%); Met by a lower layer: 1 of 343 (0.3%); Not applicable (classification can be revisited): 41 of 343 (12.0%). Optional ceiling: 124 of 124 (100.0%). Lowest mandatory ceiling: rfc7012 1 of 6 (16.7%). Lowest optional ceiling: rfc3954 12 of 12 (100.0%). Ceilings describe current classifications, not an immutable Linux maximum. Not-applicable and feature-declined classifications can be revisited. Every gap remains work Ze owes.
Tree
Roots first: an RFC sits one level above the highest level of the RFCs it builds on, and the RFCs of one citation cycle share a level. Each bar is the share of that figure's rows a recorded break proves; the ceiling below it shows attainable rows under current classifications. An RFC that is not walked shows an empty bar and no figure or ceiling. The last column names the summary whose Use cases row declares the RFC: a normative citation never adds one.
Level 0
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 3954 | Cisco Systems NetFlow Services Export Version 9 | Ceiling: 5 of 14 (35.7%); excluded: Not applicable (classification can be revisited): 9 of 14 (64.3%) | Ceiling: 12 of 12 (100.0%) | ddos-flowspec: required by rfc/short/rfc3954.md |
Level 1
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 5635 | Remote Triggered Black Hole Filtering with Unicast Reverse Path Forwarding (uRPF) | Ceiling: no rows | Ceiling: 1 of 1 (100.0%) | ddos-flowspec: required by rfc/short/rfc5635.md |
Level 3
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 4271 | A Border Gateway Protocol 4 (BGP-4) | Ceiling: 126 of 133 (94.7%); excluded: Not applicable (classification can be revisited): 7 of 133 (5.3%) | Ceiling: 34 of 34 (100.0%) | ddos-flowspec: required by rfc/short/rfc4271.md |
| SFLOW-V5 | sFlow: A Method for Monitoring Traffic in Switched and Routed Networks | Ceiling: 29 of 32 (90.6%); excluded: Optional feature not offered (classification can be revisited): 1 of 32 (3.1%); Met by a lower layer: 1 of 32 (3.1%); Not applicable (classification can be revisited): 1 of 32 (3.1%) | Ceiling: 11 of 11 (100.0%) | ddos-flowspec: required by rfc/short/sflow-v5.md |
Level 5
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 4360 | BGP Extended Communities Attribute | Ceiling: 2 of 5 (40.0%); excluded: Not applicable (classification can be revisited): 3 of 5 (60.0%) | Ceiling: 4 of 4 (100.0%) | ddos-flowspec: required by rfc/short/rfc4360.md |
| RFC 4760 | Multiprotocol Extensions for BGP-4 | Ceiling: 6 of 6 (100.0%) | Ceiling: 11 of 11 (100.0%) | ddos-flowspec: required by rfc/short/rfc4760.md |
| RFC 7011 (cycle with rfc7012) | Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information | Ceiling: 27 of 50 (54.0%); excluded: Optional feature not offered (classification can be revisited): 10 of 50 (20.0%); Not applicable (classification can be revisited): 13 of 50 (26.0%) | Ceiling: 7 of 7 (100.0%) | ddos-flowspec: required by rfc/short/rfc7011.md |
| RFC 7012 (cycle with rfc7011) | Information Model for IP Flow Information Export (IPFIX) | Ceiling: 1 of 6 (16.7%); excluded: Not applicable (classification can be revisited): 5 of 6 (83.3%) | Ceiling: no rows | ddos-flowspec: required by rfc/short/rfc7012.md |
Level 7
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 7606 (cycle with rfc4364, rfc4659, rfc4798, rfc6368, rfc8277, rfc8950) | Revised Error Handling for BGP UPDATE Messages | Ceiling: 52 of 53 (98.1%); excluded: Not applicable (classification can be revisited): 1 of 53 (1.9%) | Ceiling: 4 of 4 (100.0%) | ddos-flowspec: required by rfc/short/rfc7606.md |
Level 8
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 7999 | BLACKHOLE Community | Ceiling: 4 of 4 (100.0%) | Ceiling: 12 of 12 (100.0%) | ddos-flowspec: required by rfc/short/rfc7999.md |
| RFC 8955 | Dissemination of Flow Specification Rules | Ceiling: 27 of 29 (93.1%); excluded: Not applicable (classification can be revisited): 2 of 29 (6.9%) | Ceiling: 20 of 20 (100.0%) | ddos-flowspec: required by rfc/short/rfc8955.md |
Level 9
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 8956 | Dissemination of Flow Specification Rules for IPv6 | Ceiling: 9 of 9 (100.0%) | Ceiling: 5 of 5 (100.0%) | ddos-flowspec: required by rfc/short/rfc8956.md |
| RFC 9117 | Revised Validation Procedure for BGP Flow Specifications | Ceiling: 2 of 2 (100.0%) | Ceiling: 3 of 3 (100.0%) | ddos-flowspec: required by rfc/short/rfc9117.md |
Optional (not counted)
RFCs this use case lists as optional, each declared by the Optional use cases row of its own summary. They count in none of the figures above until the owner brings one into scope by moving it to the Use cases row. Their own figures: mandatory no rows, optional no rows; ceiling mandatory no rows, optional no rows; 1 RFCs, 0 not walked.
Mandatory ceiling: no rows. Optional ceiling: no rows. Ceilings describe current classifications, not an immutable Linux maximum. Not-applicable and feature-declined classifications can be revisited. Every gap remains work Ze owes.
| RFC | Title | Mandatory | Optional | Why it is here |
|---|---|---|---|---|
| RFC 3882 | Configuring BGP to Block Denial-of-Service Attacks | Ceiling: no rows | Ceiling: no rows | ddos-flowspec: optional in rfc/short/rfc3882.md |