Thomas Mangin

ExaBGP - A new Tool to Interact with BGP

Thomas Mangin

ExaBGP is a new application designed to provide an easy way for programmers and system admistrators to interact with BGP networks.

ExaBGP is a new application designed to provide an easy way for programmers and system admistrators to interact with BGP networks. The program is designed to allow the injection of arbitrary routes into a network, including IPv6 and FlowSpec.

Many security professionals are currently using NetFlow to monitor their network and react to DDOS attacks. By centralising their traffic information in one place, they are able to corrolate the information and detect more and more advanced attacks.
Many networks then use BGP to blackhole the destination IP of the attack at their edge, protecting their network core but still allowing the attacker to succeed. 

RFC 5575 , better known as FlowSpec, was designed to help security professionals react to such attacks in a more fine grained manner, by allowing precise filtering rules to be deployed, through BGP, to routers with advanced ASICS features.

ExaBGP is currently the only open source implementation of a route injector able to generate and propagate Flow Routes. 

Getting Started
ExaBGP is available on Google Code   and will run on most Unix flavours with any recent version of python 2 (2.4 to 2.7).
Simply untar the code into /opt, or any directory of your choice, then edit one of the template files in the etc/bgp folder to reflect what you want to do, and finally test your configuration calling “bin/bgpd” with your configuration as the first parameter.

What does it look like ...  

The configuration contains the usual BGP information fields; Cisco, Juniper, Quagga and BIRD users should find their mark very quickly.

A mixed IPv4/Flow configuration would look like the following:
neighbor {
  description "a quagga test peer";
  local-as 65000;
  peer-as 65000;

  static {
    route {
      community [ 30740:30740 30740:0 ];
      local-preference 200;
    route next-hop local-preference 200;
  flow {
    route slow-down-the-proxy-for-the-office {
      match {
        destination-port >8080&<8088 =3128;
        source-port >1024;
        protocol tcp;
      then {
        rate-limit 9600;

We would love to hear from you...

The program wiki  has more information on how to install and configure the application.

As usual, comments and feedback are welcome. Feel free to use the site's bug tracker to contact us.

You can as well email or jabber the author at thomas.mangin AT

About the author

Thomas Mangin is Technical Director at Exa Networks Limited, a  B2B ISP based in the north of England.



You may also like

View more

About the author

Thomas Mangin Based in Bradford UK

Comments 11