AutomatedAutomated
DDoS MitigationDDoS Mitigation
A BGP FlowSpec policy daemon that bridges the gap between attack detection and router enforcement. Built in Rust.
Bridge the gap between
detection and enforcement
You have detectors that know when you're under attack. You have routers that can filter at line rate. prefixd connects them.
Manual CLI or fragile scripts
Automated policy engine
Minutes (operator intervention)
Seconds (API-driven)
Easy to fat-finger, no guardrails
Quotas, safelist, /32-only, TTLs
Scattered logs, no audit trail
Dashboard, metrics, audit log
Forget to remove rules
Auto-expire via TTL
Key idea: Detectors signal intent, prefixd decides policy.
No detector ever speaks BGP directly.
How it works
From detection to mitigation in seconds, not minutes
Policy Engine
YAML playbooks define per-vector responses with police or discard actions
Guardrails
Quotas, safelist, /32-only enforcement, mandatory TTLs for safety
Reconciliation
Auto-expires mitigations, repairs RIB drift, fail-open design
Attack Detected
High-volume traffic from multiple sources
Mitigation Applied
FlowSpec rules deployed to edge routers
Features
Everything you need for production DDoS mitigation
Signal Ingestion
HTTP API accepts attack events from any detector
Policy Engine
YAML playbooks define per-vector responses
Guardrails
Quotas, safelist, /32-only enforcement
BGP FlowSpec
Announces via GoBGP with traffic-rate & discard
Reconciliation
Auto-expires mitigations, repairs RIB drift
Dashboard
Real-time web UI with WebSocket updates
Authentication
Three roles: admin, operator, viewer
Observability
Prometheus metrics, structured logs, audit trail
Supported Routers
Get started in under a minute
Four steps to production-ready DDoS mitigation
Clone and configure
git clone https://github.com/lance0/prefixd.git
cd prefixd
cp .env.example .envStart the stack
docker compose up -dCreate admin account
docker compose exec prefixd prefixdctl operators create \
--username admin --role adminOpen the dashboard
open http://localhost:3000Running services
| Service | Purpose | Ports |
|---|---|---|
| prefixd | Policy daemon | 8080, 9090 |
| dashboard | Web UI | 3000 |
| gobgp | BGP route server | 179, 50051 |
| postgres | State storage | 5432 |
Ready to protect your network?
View Documentation