AutomatedAutomated
DDoS MitigationDDoS Mitigation
A BGP FlowSpec policy daemon that bridges the gap between attack detection and router enforcement, announcing through rustbgpd over gRPC. Built in Rust.
Bridge the gap between
detection and enforcement
You have detectors that know when you're under attack. You have routers that can filter at line rate. prefixd connects them.
Manual CLI or fragile scripts
Automated policy engine
Minutes (operator intervention)
Seconds (API-driven)
Easy to fat-finger, no guardrails
Quotas, safelist, /32-only, TTLs
Scattered logs, no audit trail
Dashboard, metrics, audit log
Forget to remove rules
Auto-expire via TTL
Key idea: Detectors signal intent, prefixd decides policy.
No detector ever speaks BGP directly.
How it works
From detection to mitigation in seconds, not minutes
Policy Engine
YAML playbooks define per-vector responses with police or discard actions
Guardrails
Quotas, safelist, IPv4 /32 and IPv6 /128 host routes, mandatory TTLs
Reconciliation
Auto-expires mitigations, repairs RIB drift, fail-open design
Attack Detected
High-volume traffic from multiple sources
Mitigation Applied
FlowSpec rules deployed to edge routers
Pairs with rustbgpd
prefixd decides what to mitigate; rustbgpd, an API-first BGP daemon in Rust, owns the BGP sessions. prefixd drives it over typed gRPC calls, and the rustbgpd Compose profile is the default path. GoBGP stays maintained and selectable.
Features
Everything you need for production DDoS mitigation
Signal Ingestion
HTTP API accepts attack events from any detector
Policy Engine
YAML playbooks define per-vector responses
Guardrails
Quotas, safelist, IPv4 /32 and IPv6 /128 host routes
BGP FlowSpec
Announces through rustbgpd over gRPC, or GoBGP, with police & discard
Reconciliation
Auto-expires mitigations, repairs RIB drift
Dashboard
Real-time web UI with WebSocket updates
Authentication
Three roles: admin, operator, viewer
Observability
Prometheus metrics, structured logs, audit trail
Router Compatibility
FRR receiving prefixd's FlowSpec rules is control-plane evidence, not router enforcement. Requalify your router software, address family and action; see the vendor reference.
Get started in under a minute
Four steps to a local stack with rustbgpd, from published images
Clone the repository
git clone https://github.com/lance0/prefixd.git
cd prefixdStart the rustbgpd profile
docker compose --profile rustbgpd up -d --pull always --no-buildCreate admin account
docker compose exec prefixd-rustbgpd prefixdctl operators create \
--username admin --role adminOpen the dashboard
open http://localhostRunning services
| Service | Purpose | Ports |
|---|---|---|
| nginx | Dashboard and API | 80 |
| prefixd-rustbgpd | Policy controller | internal |
| rustbgpd | BGP speaker, gRPC on a private socket | 179 |
| dashboard | Web UI | internal |
| postgres | State storage | internal |
| prometheus, grafana | Metrics (host loopback) | 9091, 3001 |
The sample peer uses a documentation address and stays Idle until you configure your edge router in configs/rustbgpd.toml.
Prefer GoBGP? Start a fresh deployment with the GoBGP profile:
docker compose --profile gobgp up -d --pull always --no-buildRun controller commands in prefixd-gobgp, and run one profile at a time.
Ready to protect your network?
View Documentation