All DDoS Definitions
DDoS Testing Definition

Null Routing (Blackholing)

Null routing (also called blackholing) is a defensive control, the blunt-instrument response a DDoS test often reveals as the only fallback when finer mitigation is missing. It installs a route that sends all traffic for a targeted IP to a null interface, where the kernel silently discards it. The flood stops reaching the network, but so does every legitimate packet to that address: the host is sacrificed to protect the rest of the infrastructure. RTBH (remotely triggered black hole) automates this across a network via BGP.

Null routing: sacrifice one IP to save the rest Attack flood aimed at target IP Legit users same target IP Edge router route: target IP to Null0 interface RTBH triggers it via BGP Null0 kernel discards all attack and users both dropped The fleet host .10 target null-routed, offline host .11, reachable host .12, reachable host .13, reachable Blackholing completes the attacker's goal for that one IP: the flood stops, but so does every real packet. It is containment, not protection. The host is given up to keep the rest of the infrastructure online. A test exposes how much service depends on a single IP, and pushes the defense upstream toward scrubbing. BlackNeuron
Diagram: null routing sends a targeted IP to Null0, dropping attack and users alike to keep the rest of the fleet online

Why it matters in DDoS testing

Null routing is a containment tactic, not protection: it completes the attacker's goal of making the target unreachable. A test exposes how much of the service depends on a single IP, so operators know the real cost of pulling the trigger, and pushes the defense upstream toward scrubbing that drops attack traffic while keeping the host online.

For how to measure resilience instead of relying on blackholing, see DDoS Resilience Testing.