On this page
Key points
- Count IP bytesFlowSpec Type 10 matches IP packet length, not Ethernet frame size or application payload size.
- A size is not an attack signatureLegitimate traffic can share the same length. Combine evidence with a precisely authorized scope.
- Verify enforcement and withdrawalA received BGP rule is not proof of forwarding behavior; test the dataplane and the removal procedure.
Why a repeated length needs more evidence
A flood may contain many packets of the same size, which makes packet length a useful investigation field. The same repetition also occurs in legitimate keepalives, acknowledgements and game traffic. A histogram peak is a candidate observation, not permission to discard every packet at that length.
Start with the affected destination, protocol, traffic direction and service behavior. Compare incident samples with successful normal sessions, reconnects and application updates. Sampling and truncated captures can hide variation, so record how the evidence was collected.
IPv4 Type 10 counts the whole IP packet
RFC 8955 defines the length component in terms of the complete IP packet, including its IP header and excluding Layer 2. Do not paste a captured Ethernet length or UDP payload length into a rule as though those numbers described the same thing.
For example, an unfragmented IPv4 packet with a 20-byte IP header, 8-byte UDP header and 32-byte payload has IP length 60 bytes. Without VLAN tags, its Ethernet frame is 78 bytes including FCS. Nominal wire occupancy adds another 20 bytes. These are different measurements of the same example.
| Measurement in this example | Bytes | Meaning |
|---|---|---|
| UDP payload | 32 | Application data only. |
| IPv4 packet | 60 | IP header, UDP header and payload: the Type 10 length. |
| Ethernet frame with FCS | 78 | 14-byte Ethernet header plus IP packet plus 4-byte FCS. |
| Nominal wire occupancy | 98 | Frame plus preamble and inter-frame time. |
Combine a length with an explicit traffic scope
Restrict a candidate rule to the authorized destination prefix and the intended IP protocol. If ports are relevant, distinguish source port, destination port and the component that can match either. Their meaning changes with traffic direction. Use only the conditions and actions supported by the receiving implementation.
Length is not a parser for an application protocol. A UDP size rule does not prove that a packet belongs to FiveM, and Minecraft Java’s main game connection is TCP. Do not transfer a rule between services merely because both are games. A compatible application control may be needed when legitimate and unwanted packets overlap.
Check the measurement layer again when traffic is encapsulated. A rule evaluated against an outer tunnel packet is not automatically matching the inner service packet. This article’s byte example is IPv4; validate IPv6 extension headers, fragments and implementation behavior separately.
Before enforcing a candidate rule
Record evidence and ownership
Keep representative authorized captures or counters, the normal baseline, affected destination and the operator responsible for the rule. Specify the expected benefit and possible legitimate matches.
Check the exact match
Verify units, boundaries, protocol, port direction and fragment behavior. Compare the rendered rule with the intended conditions; test supported packet variations in an isolated environment.
Prove installation and service health
Confirm both control-plane acceptance and actual dataplane installation. Inspect the implementation’s match counters and perform legitimate application checks through the protected path.
Bound and remove the change
Set an explicit review or withdrawal time in the operating procedure or controller. BGP FlowSpec does not provide a general automatic per-rule expiry. Test removal and the resulting forwarding state.
Example: one destination, one observed unwanted pattern
Suppose evidence for your own UDP service shows an unwanted IPv4 pattern concentrated at a particular IP length, while normal traffic has been measured independently. First count the candidate matches without dropping if the platform supports that mode. Otherwise use an isolated test path; do not assume a non-dropping mode exists.
If legitimate traffic overlaps, narrow or abandon the condition instead of expanding a broad range. If a bounded rule is justified, monitor service success as well as reduced attack traffic. A lower bandwidth graph with broken clients is not a successful mitigation.
Non-initial fragments do not contain the original transport header. A rule that also requires a UDP port therefore needs particular care: the standard’s port matching does not match those non-initial fragments. Do not conclude that one port-and-length rule covers an entire fragmented datagram.
Common mistakes that change the rule’s meaning
- Matching an Ethernet capture length when the rule expects IP packet length.
- Applying a length condition to every destination or protocol because one service is attacked.
- Confusing source and destination ports on reflected or returning traffic.
- Assuming all fragments carry a UDP or TCP header that can be matched.
- Treating a route accepted by BGP as proof that hardware resources installed the filter.
- Leaving an incident rule active without an owner, review time or tested withdrawal.
Connect the rule to a complete operating procedure
Record rule scope, version, approval authority, installation outcome, counters and removal outcome together. The upstream acceptance policy and supported actions are part of the service contract; an advertised FlowSpec capability alone does not establish them.
Questions and answers
Does packet length mean the UDP payload size?
No. For the IPv4 example here, it includes the IPv4 header and UDP header as well as the payload, while excluding the Ethernet layer.
Can a fixed length identify every malicious packet?
No. Legitimate and unwanted packets can share the same length. Use evidence, a narrow authorized scope and service-level validation.
Will a temporary FlowSpec rule expire on its own?
Do not assume so. Arrange expiry or withdrawal in the controller or operating procedure, and verify that the enforcement disappears as intended.
