Combination of remote triggered source and destination blackhole filtering

1. A method, comprising:

assigning each border router able to transmit attack traffic a respective unique border gateway protocol community value (BGPCV);

advertising an advertised BGPCV;

advertising a first modified next hop address for a destination address of network traffic;

advertising a second modified next hop address for a source address of network traffic;

overwriting a first next hop address of the destination address with the first modified next hop address, wherein the first next hop address is overwritten when the advertised BGPCV matches the unique BGPCV and wherein the first next hop address is not overwritten when the advertised BGPCV does not match the unique BGPCV;

forwarding filtered traffic to the first modified next hop address, wherein filtered traffic comprises only network traffic addressed to the destination address or from the source address;

transporting filtered traffic via a sinkhole tunnel;

receiving the filtered traffic from the sinkhole tunnel;

overwriting a second next hop address of the source address to a second modified next hop address, wherein the second next hop address is overwritten when the advertised BGPCV matches the unique BGPCV and wherein the second next hop address is not overwritten when the advertised BGPCV does not match the unique BGPCV; and

forwarding attack traffic to a discard interface, wherein attack traffic is filtered traffic that is both addressed to the destination address and from the source address.

2. The method of claim 1 , wherein the sinkhole tunnel comprises one or more Multi-Protocol Label Switching tunnel with Virtual Private Network routing and forwarding.

3. The method of claim 1 , further comprising:

assigning border gateway protocol community values to a group of more than one border routers.

4. The method of claim 1 , wherein the first modified next hop address is an address of a sinkhole tunnel, and the second modified next hop address is an address of a discard interface.

5. The method of claim 1 , wherein the first modified next hop address is an address of a discard interface, and the second modified next hop address is an address of a sinkhole tunnel.

6. The method of claim 1 , further comprising:

reinjecting non-attack traffic into a core network associated with the destination address.

7. The method of claim 1 , wherein a set of next hop addresses for all network traffic having a network prefix of a subnetwork of the destination address is overwritten by the first modified next hop address.

8. A remote triggered combined destination and source IP address black hole filtering apparatus comprising:

a remote triggered destination address black hole filter (RTDBHF) unit having a first border gateway protocol community value (BGPCV) to identify the RTDBHF unit, the RTDBHF unit comprising:

one or more processors;

a first route information listing, wherein the route information listing includes a routing table or forwarding information base;

a non-transitory computer readable medium containing machine-readable instructions, which, when read by the one or more processors, causes the one or more processors to:

receive a first advertisement having a first modified next hop address for a destination address of network traffic;

receive a first advertised BGPCV from the first advertisement; and

overwrite a first next hop address of the destination address with the first modified next hop address in the first route information listing, wherein the first next hop address is overwritten when the first advertised BGPCV matches the first BGPCV and wherein the first next hop address is not overwritten when the first advertised BGPCV does not match the BGPCV;

a remote triggered source address black hole filter (RTSBHF) unit having a second BGPCV to identify the RTSBHF unit, the BHF unit comprising:

one or more processors;

a second route information listing, wherein the second route information listing includes a routing table or forwarding information base;

a non-transitory computer readable medium containing machine-readable instructions, which, when read by the one or more processors, causes the one or more processors to:

receive a second advertisement having a second modified next hop address for a source address of network traffic;

receive a second advertised BGPCV from the second advertisement; and

overwrite a second next hop address of the source address with the second modified next hop address in the second route information listing, wherein the second next hop address is overwritten when the second advertised BGPCV matches the second BGPCV, and wherein the second next hop address is not overwritten when the second advertised BGPCV does not match the second BGPCV;

wherein one of the RTDBHF unit or the RTSBHF unit is configured to forward filtered traffic to one of the first modified next hop address or second modified next hop address, the filtered traffic comprising only network traffic that addressed to the destination address or from the source address;

wherein a sinkhole tunnel is configured to communicatively couple the RTDBHF unit to the RTSBHF unit;

wherein one of the one of the RTDBHF unit or the RTSBHF unit is configured to transport the filtered traffic via the sinkhole;

wherein the other of the RTDBHF unit or the RTSBHF unit is configured to receive the filtered traffic from the sinkhole; and

wherein the other of the RTDBHF unit or the RTSBHF unit is configured to forward attack traffic to a discard interface, attack traffic being filtered traffic that is both addressed to the destination address and addressed from the source address.

9. The apparatus of claim 8 , wherein the first advertised BGPCV and the second advertised BGPCV are the same.

10. The apparatus of claim 8 wherein the first modified next hop address is an address of a discard interface, and the second modified next hop address is an address of the sinkhole tunnel.

11. The apparatus of claim 8 , wherein the sinkhole tunnel comprises one or more Multi-Protocol Label Switching tunnel with Virtual Private Network routing and forwarding.

12. The apparatus of claim 8 , wherein the sinkhole tunnel comprises one or more generic routing encapsulation (“GRE”) network tunnels.

13. The apparatus of claim 8 , wherein the RTDBHF unit and the RTSBHF unit are part of a single router.

14. The apparatus of claim 8 , wherein a set of next hop addresses for all network traffic having a network prefix of a subnetwork of the destination address is overwritten by the first modified next hop address.

15. The apparatus of claim 8 , wherein the first modified next hop address is an address of a sinkhole tunnel, and the second modified next hop address is an address of a discard interface.

16. A system for combined remote triggered destination and source IP address black hole filtering comprising: a core network in communication with an external network, and a subnetwork, the core network comprising:

an internal border gateway protocol router, comprising:

one or more first processors; and

a first non-transitory computer readable medium containing machine readable instructions, which, when read by the one or more first processors, cause the internal border gateway protocol router to:

generate a customized internal border gateway protocol advertisement, wherein the advertisement includes a first modified next hop address for a destination address of network traffic, and a second modified next hop address for a source address of network traffic;

a first set of one or more remote triggered destination address black hole filtering (RTDBHF) routers, each RTDBHF router having a respective first border gateway protocol community value (BGPCV) to identify the particular RTDBHF router and comprising:

one or more second processors; and

a second non-transitory computer readable medium containing machine readable instructions, which, when read by the one or more first processors, cause the particular RTDBHF router to:

receive a first advertisement having a first modified next hop address for a destination address of network traffic;

receive a first advertised BGPCV from the first advertisement;

overwrite a first next hop address of the destination address with the first modified next hop address in a first route information listing, wherein the first route information listing includes a routing table or forwarding information base, wherein the first next hop address is overwritten when the first advertised BGPCV matches the first BGPCV and wherein the next hop address is not overwritten when the first advertised BGPCV does not match the first BGPCV; and

a second set of one or more remote triggered source address black hole filtering (RTSBHF) routers, each RTSBHF router having a respective second BGPCV to identify the particular RTSBHF router and comprising:

one or more third processors; and

a third non-transitory computer readable medium containing machine-readable instructions, which, when read by the one or more third processors, cause the particular RTSBHF router to:

receive a second advertisement having a second modified next hop address for a source address of network traffic;

receive a second advertised BGPCV from the second advertisement; and

overwrite a second next hop address of the source address with the second modified next hop address in a second route information listing, wherein the second route information listing includes a routing table or forwarding information base, wherein the second next hop address is overwritten when the second advertised BGPCV matches the second BGPCV, and wherein the second next hop address is not overwritten when the second BGPCV does not match the second BGPCV;

wherein a particular RTDBHF router of the first set of the first set or a particular RTSBHF router of the second set is configured to forward filtered traffic to one of the first modified next hop address or second modified next hop address, the filtered traffic comprising only network traffic that is addressed to the destination address or from the source address;

wherein a sinkhole tunnel is configured to communicatively couple the particular RTDBHF router to the particular RTSBHF router;

wherein one of the one of the particular RTDBHF router or the RTSBHF router is configured to transport the filtered traffic via the sinkhole;

wherein the other of the particular RTDBHF router or the particular RTSBHF router is configured to receive the filtered traffic from the sinkhole; and

wherein the other of the particular RTDBHF router or the particular RTSBHF router is configured to forward attach attack traffic to a discard interface, attack traffic being filtered traffic that is both addressed to the destination address and addressed from the source address.

17. The system of claim 16 , wherein the first advertised BGPCV and the second advertised BGPCV are the same.

18. The system of claim 16 , wherein a set of next hop addresses for all network traffic having a network prefix of a subnetwork of the destination address is overwritten by the first modified next hop address.

19. The system of claim 16 , wherein the first modified next hop address is an address of a sinkhole tunnel, and the second modified next hop address is an address of a discard interface.

20. The system of claim 16 , wherein the first modified next hop address is an address of a discard interface, and the second modified next hop address is an address of a sinkhole tunnel.