BGP FlowSpec
BGP FlowSpec advertises traffic filtering and handling rules through BGP. In Peresvet ST, FlowSpec rules are defined within a BGP session. They let you verify how equipment accepts rules matching destination/source, protocol, ports, ICMP, TCP flags, packet length, DSCP, and fragmentation.
Table 223 — BGP FlowSpec Parameters
| Name | Description | Value |
|---|---|---|
| Rule | Individual FlowSpec rule | Add one or more rules |
| AFI | Rule address family | IPv4 or IPv6 |
| Components | Match components in the rule | Add destination, source, protocol, ports, and other conditions |
| AND with previous | Logical relationship to the previous component | Enable when multiple conditions must apply together |
| Operator | Comparison operator | ==, !=, <, >, <=, >= |
| Value | Comparison value | CIDR for source/destination; a number for other types |
Table 224 — BGP FlowSpec Component Types
| Type | Purpose | Example value |
|---|---|---|
| destination | Destination prefix | 10.10.0.0/16 |
| source | Source prefix | 192.0.2.0/24 |
| protocol | IP protocol number | 6 for TCP, 17 for UDP |
| destination-port | Destination port | 443 |
| source-port | Source port | 1024 |
| icmp-type | ICMP type | 8 for echo request |
| icmp-code | ICMP code | 0 |
| tcp-flags | TCP flags | Numeric flag value |
| packet-length | Packet length | For example, 1500 |
| dscp | DSCP | For example, 46 for EF |
| fragment | Fragmentation attribute | Numeric component value |
Before starting, make sure that the BGP session has negotiated the FlowSpec address family and that the DUT supports the selected FlowSpec type. After starting, verify that the BGP peer has accepted the rules and applied them to the intended traffic. For a safe initial test, use narrow prefixes and a small number of rules.