Transit built for networks that want control

Another way in for match-and-action rules, over the BGP session you already run with us. Useful when your existing tooling speaks FlowSpec already.

• Prefix, port, protocol, length, flags, DSCP
• Discard, rate-limit, redirect or mark
• Withdraw the route and the rule is gone

route drop-memcached {
    match {
        destination 203.0.113.0/24;
        protocol udp;
        destination-port 11211;
    }
    then discard;
}

Illustrative. Junos-style syntax shown. Supported matches, actions and limits are in the onboarding reference.

Steering per prefix using the same communities we use internally, including one that raises a prefix to the strictest filtering profile.

• Blackhole a /32 in seconds
• Prepend toward an upstream or region
• Force full inspection during an incident

203.0.113.7/32      blackhole
203.0.113.0/24      prepend x2 toward carrier A
198.51.100.0/22     strictest filtering profile

Illustrative. Intent shown, not values; the community reference is provided during onboarding.

Where policy alone is not enough, write your own filtering and steering logic and deploy it to our edge, where it runs inline in the forwarding path beside our stack.

• Runs at the ingress PoP, on the same port
• A parser for your own protocol
• A classifier trained on your own game

// drop handshakes that do not follow our sequence
export function inspect(pkt, session) {
  if (pkt.udp && !session.sawHello && pkt.payload[0] !== 0x01) {
    return DROP
  }
  return PASS
}

Illustrative. Pseudocode; the runtime and its interface are scoped with you.