All DDoS Definitions
DDoS Testing Definition

RTBH (Remotely Triggered Black Hole)

RTBH (remotely triggered black hole) is the control that sacrifices one address to save the network: it withdraws the target from normal routing and sends every packet bound for it to the floor. Whether that trade is even survivable, and how fast the withdrawal propagates, is what a DDoS test measures. It is the bluntest instrument in the routing toolbox, and often the only one a network has when a flood is too large to absorb.

RTBH: null-route the target, all traffic to it is dropped Attack traffic dst = target IP Legitimate users dst = same IP Edge router BGP announcement: null-route the /32 at the network edge all traffic to the /32 Null0 (discard) attack AND legitimate traffic dropped alike the target goes dark Protects the rest of the network, not the target black-holing one /32 can strand others that share the prefix A test characterizes how fast the route propagates and whether black-holing one target strands services on the same prefix. BlackNeuron™
RTBH: a BGP null-route drops all traffic to the target, attack and legitimate alike

How the trigger propagates

Local null routing discards traffic on a single box. RTBH does the same thing, but signals the decision across a whole network, and across network boundaries, with BGP. That distribution is the entire point of the technique.

An operator announces the target address, usually as a specific /32, carrying a pre-agreed BGP community. Every router that honors that community rewrites the route's next hop to a discard address pointed at a null interface. Within seconds the announcement has propagated to the network edge, and traffic for that address is dropped at ingress rather than carried across the core to congest it.

The same community can be handed upstream. Many carriers publish a blackhole community a customer can tag onto an announcement, so a downstream network under attack can ask its provider to drop the traffic one hop earlier, before it ever reaches the customer's own circuit. The common form is destination-based, keyed on the address under attack; a source-based variant (S/RTBH) uses reverse-path filtering to discard by origin address instead, though spoofing limits how useful that is.

Why it matters under attack

RTBH is containment, not protection. It completes the attacker's goal for them: the target is unreachable, deliberately, by your own hand. Every legitimate user of that address is dropped alongside the flood, so the value is entirely in what it protects, the rest of the network that keeps running, not in what it saves.

That makes blast radius the question that decides whether it is usable at all. Black-holing a /32 strands one address; if critical services share it, or if the only workable announcement is a wider prefix, the collateral grows fast. More selective tools like BGP Flowspec and diversion to a scrubbing center exist to avoid the all-or-nothing choice, and a sinkhole keeps the traffic for analysis where a blackhole simply discards it.

RTBH: the target address withdrawn to the discard route upstream router BGP blackhole route /32 tagged, next-hop discard rest of network unaffected Null0 / discard all traffic to the /32 the blackholed address is sacrificed: legitimate traffic to it is dropped alongside the attack BlackNeuron™
Animated RTBH: a BGP announcement tags the target address with a blackhole community so upstream routers send all its traffic to a discard route, keeping the rest of the network clear while the address itself goes dark

What a DDoS test measures

A test that exercises RTBH times the diversion latency, how quickly the route propagates from trigger to the traffic actually stopping, and maps the blast radius: how many legitimate services share the address or prefix that would be black-holed. It also confirms the route can be withdrawn cleanly afterward, restoring the address without a second outage.

What black-holing an address really costs, and whether upstream scrubbing could have kept it online instead, is worked through in DDoS resilience testing.