When a router's most specific route for an address points at a discard interface, every packet for that address is dropped the instant the lookup finishes, with no filter, no inspection and no reply. The flood stops, and so does every legitimate connection to the same address. That is a null route (also called blackholing), the blunt fallback a DDoS test often reveals as the only one available when finer mitigation is missing.
How the discard happens
A null route is an ordinary route with an unusual next hop. On most routers it is a static entry pointing at Null0 or a discard interface; on Linux it is ip route add blackhole <address>. Longest-prefix match does the rest: a /32 to the discard interface wins over the /24 that would otherwise forward the traffic, so only that one address goes dark.
Because the drop happens during forwarding rather than in a filter, it is about as cheap as packet handling gets, and it runs at line rate on hardware that would struggle to evaluate an access list at the same speed. Operators normally disable ICMP unreachable messages on the discard interface too, so the router does not answer a flood with a flood of its own.
The same mechanism has a quieter, everyday job. Networks install a discard route for each aggregate they announce, so that traffic for an unused part of the block is dropped locally instead of looping.
Where it is applied decides what it saves
A null route only relieves what lies beyond the router that holds it: the core, the firewalls and the hosts between that router and the target. Install it on your own edge and the flood still crosses your transit circuit before it is discarded; if that circuit is full, every other address behind it is still down. This is why null routing on its own rarely rescues a network from a volumetric attack.
RTBH exists to move the same discard further out. It signals the decision with BGP so that a provider's routers drop the traffic before it reaches you, and it reuses the local null route as its target: the trigger rewrites the next hop to a reserved address that every edge router already points at the discard interface.
Many hosting and cloud providers apply it automatically. When the traffic to one customer address crosses a threshold, the provider null-routes it for a fixed cool-down to protect shared infrastructure. The customer did not choose the outage and usually cannot shorten it.
What a DDoS test measures
First, the trigger. Where a provider null-routes automatically, the test establishes the volume or packet rate at which it fires and how long the cool-down lasts, because that threshold is the real ceiling of the free protection. It belongs on an address you can afford to lose for the window.
Second, the cost. The test maps how much depends on the address that would be sacrificed: shared virtual hosts, an API and a website on one IP, a DNS record that has no second answer. Null routing a dedicated address is a small loss; null routing one that fronts the whole product is the attacker's job done for them.
Third, recovery. Once the route is removed, traffic should resume without a second incident. A route left behind by hand, or a cool-down that restarts because residual attack traffic is still arriving, can keep a service dark long after the flood ends.
The same reasoning applies to a provider that null-routes a customer address on its own, which the Alibaba Cloud DDoS testing guide works through.