All DDoS Definitions
DDoS Testing Definition

BGP Flowspec

BGP Flowspec (RFC 8955) is a network-layer defensive control, one of the protections a thorough DDoS test is built to exercise. It distributes granular packet-filter rules across routers using BGP itself, so an operator can push a match-and-action policy (drop, rate-limit, or redirect by source, destination, protocol, port, or packet length) to the whole edge in seconds. It is a finer instrument than RTBH, which null-routes an entire destination IP.

BGP Flowspec vs RTBH: granular drop vs whole IP One rule reaches every edge router via BGP in seconds. Match on proto / port / length, action drop or rate-limit. Flowspec: match and drop the flow Attack flow matches rule Legit flow no match Edge Flowspec attack flow dropped legit flow served RTBH: null-route the whole IP Attack flow to the IP Legit flow same IP Null0 all to the IP attack dropped legit dropped too collateral A test measures how fast a Flowspec rule reaches the edge and whether its match catches the attack without collateral. BlackNeuron™
BGP Flowspec drops only the flow matching a granular rule so legitimate traffic survives, while RTBH null-routes the whole destination IP and takes legitimate traffic down with it

Why it matters in DDoS testing

Flowspec is only useful if rules propagate and take effect fast enough to beat the attack. A test measures propagation time from rule injection to edge enforcement, confirms the match criteria actually catch the attack signature without collateral damage, and checks that upstream providers honor the advertised rules. A correct policy that arrives after the link saturates is a post-mortem, not a defense.

For where edge filtering sits in overall posture, see DDoS resilience testing.