BGP Flow Specification Extension for Feedback Binding#

Yong Cui (Tsinghua University), Yujia Gao, Lei Zhang (Zhongguancun Laboratory) — individual draft

• Why: FlowSpec is one-way control today: "rule delivered ≠ rule effective." DDoS scrubbing rules fail silently on local ACL conflicts, unresolved redirect next-hops, inactive rules, or vendor gaps — and the operator has no standard way to see which nodes actually enforced the mitigation. This touches the network-security interest directly, as closed-loop visibility for a security mechanism.
• What: A FlowSpec extension carrying a Feedback Action as a Generic Transitive Extended Community: a Feedback Identifier (FID), a window exponent (WINC) defining the periodic reporting interval as 2^n seconds, an event flag, and a scope selector (global / inter-AS / intra-AS) — propagated across AS boundaries unchanged.
• How: Routers report rule lifecycle state (Received → Install → Active → Effective, or Inactive/Removed/Error) and data-plane hit statistics keyed by the FID, exported via a companion mechanism (BMP or a telemetry framework). The DDoS use case: a controller pushes scrubbing redirects and detects in real time which nodes failed to activate them. Signaling only in this draft; export is future work.
• Where applicable: FlowSpec-based DDoS mitigation and traffic steering across enterprise–carrier boundaries. Early academic individual draft (-00) explicitly seeking requirements confirmation and interest; the concept (closed-loop control for FlowSpec) is more mature than the draft.