The Advanced Labeling System
Sometimes AS-Path manipulation and Local Preference aren't expressive enough. You need to attach metadata to a route that tells other networks how to handle it. This is done with BGP Communities.
A BGP Community is a numerical tag attached to a route advertisement. In the traditional format, it's a 32-bit number typically written as two 16-bit values separated by a colon: ASN:value, for example 65000:100. Large Communities (RFC 8092) extend this to a 96-bit format (ASN:value1:value2) for more expressive tagging.
Communities act like a shared vocabulary between network operators. ISPs publish their community policies in documents called IRR (Internet Routing Registry) records or on sites like PeeringDB, so customers know which tags to use.
Common use cases:
- Traffic engineering: Tag routes with
65000:200to tell your ISP to set Local Pref 200 on that route, preferring it over others. - No-export: The well-known community
65535:65281(NO_EXPORT) tells a receiving AS not to advertise the route to its own eBGP peers. - Blackhole routing (DDoS mitigation): This is the most operationally critical use case. If your network is under a volumetric DDoS attack targeting IP
203.0.113.50, your upstream link will be saturated before you can do anything. You can announce203.0.113.50/32to your ISP with their published blackhole community tag (e.g.,65000:666). The ISP's routers will then drop all traffic destined for that IP at their edge — before it ever reaches your network. Your link is saved, though the targeted IP becomes unreachable. This is called RTBH (Remotely Triggered Black Hole) routing.
# Example: Announcing a blackhole route to your ISP via a route-map
# (Cisco IOS syntax)
route-map BLACKHOLE permit 10
set community 65000:666
!
ip route 203.0.113.50 255.255.255.255 Null0
router bgp 65001
network 203.0.113.50 mask 255.255.255.255 route-map BLACKHOLE
"How would you mitigate a volumetric DDoS attack at the network layer?" is a common SRE/network engineering interview question. The answer for large-scale mitigation is RTBH via BGP communities: announce the victim IP as a /32 with your upstream's blackhole community. This drops traffic upstream before it saturates your link. The trade-off: the attacked IP becomes completely unreachable to legitimate users as well. More sophisticated alternatives include BGP Flowspec (which can filter by source IP or protocol) or scrubbing centers.
Key Point: BGP Communities enable fine-grained traffic engineering and are the primary mechanism for RTBH-based DDoS mitigation at the network layer.