What is a Null0 route, and what do you use it for?
Show the answer
Say this first
Null0 is a virtual interface that is always up and discards everything routed to it. A route to Null0 drops traffic in the forwarding plane at no CPU cost. It is used for summary discard routes that stop loops, anchor routes so BGP can announce an aggregate, remotely triggered black hole filtering during attacks, and blocking unused space. Longer routes always win over it, so it only catches traffic for parts of a block with no better route.
Go deeper
Anchor route for a BGP announcement
BGP's network statement only announces a prefix that exists in the RIB with that exact length.
interface Null0
no ip unreachables
!
ip route 198.51.100.0 255.255.255.0 Null0 name BGP-ANCHOR
!
router bgp 64500
address-family ipv4
network 198.51.100.0 mask 255.255.255.0S 198.51.100.0/24 is directly connected, Null0The /24 is always announced, even when individual subnets inside it come and go. Traffic for real subnets follows their longer IGP routes; traffic for unused addresses is dropped at the edge.
Remotely triggered black hole (RTBH)
- Every edge router has
ip route 192.0.2.1 255.255.255.255 Null0. - During an attack on 203.0.113.10, a trigger router announces 203.0.113.10/32 to the edge routers over iBGP with next hop 192.0.2.1.
- Each edge router resolves the next hop to Null0 and drops traffic to the victim at the border, before it fills internal links.
Why no ip unreachables on Null0
By default IOS answers dropped packets with ICMP unreachables, rate limited but still from the CPU. A flood toward a discard route should be dropped silently.
They will ask next
What are the equivalents on Junos and Linux?
Junos static routes take
discard(drop silently) orreject(drop and send ICMP unreachable). Linux hasip route add blackhole 198.51.100.0/24, plusunreachableandprohibitroute types that send ICMP.
Traps
- Thinking a Null0 route for an aggregate blocks the real subnets inside it. Longest match sends them to their specific routes.