use cases summary

ExaBGP Use Cases - Comprehensive Summary

Last Updated: 2025-11-09 Purpose: Reference document for documentation writers, consolidating all ExaBGP use cases from external research

Executive Summary

ExaBGP is a BGP engine that enables programmatic BGP control from applications. Unlike traditional BGP implementations that manipulate RIB/FIB, ExaBGP focuses purely on the BGP protocol layer, allowing external processes to inject and receive BGP routes.

Key Differentiator: ExaBGP pioneered open-source FlowSpec support and remains the most API-friendly implementation (now also supported by GoBGP, FRRouting, BIRD).

Primary Use Cases

1. DDoS Mitigation via FlowSpec

Description: Dynamic injection of FlowSpec rules for traffic filtering and rate limiting.

How It Works:

• Detection system (Arbor, ML, SIEM) identifies attack
• ExaBGP receives alert via syslog/API
• Generates FlowSpec rules dynamically
• Distributes via BGP to edge routers
• Routers install rules in hardware forwarding plane
• Traffic filtered/shaped at network edge

Advantages over RTBH:

• Precise matching (ports, protocols, packet length)
• Rate limiting instead of blackholing
• Single rule vs. thousands of /32 prefixes
• Surgical mitigation reduces collateral damage

Real-World Implementations:

• Integration with Arbor SP/TMS for automated response
• ElastiFlow + Elasticsearch ML for intelligent detection
• Wanguard BGP Connector for flow-based mitigation
• Upstream provider offload (traffic blocked before reaching network)

Example Scenario:

HTTP Flood Detected → FlowSpec Rule Generated → BGP Distribution →
Edge Routers Rate-Limit → Attack Mitigated in < 5 seconds

2. Anycast High Availability

Description: Multiple servers announce same service IP; traffic routed to nearest/healthiest node.

How It Works:

• Service IPs configured on loopback interfaces
• ExaBGP announces availability via BGP
• Health checks monitor service state
• Failed nodes withdraw routes automatically
• Network converges to healthy nodes

Common Applications:

• DNS Anycast: Multiple DNS servers, geographic distribution
• Web Services: Global content delivery, latency reduction
• CDN Edge Nodes: Distributed content serving
• API Endpoints: Regional API gateways

Architecture Pattern:

[Web Servers + ExaBGP] ----BGP----> [Route Servers] ----BGP----> [Edge Routers]
      (Health Checks)                 (Path Selection)              (Traffic Fwd)

Key Benefits:

• Automatic failover (5-15 second convergence)
• Geographic load distribution
• No single point of failure
• Application-aware routing

Reference: Vincent Bernat's "High Availability with ExaBGP" (2013)

3. Dynamic Load Balancing

Description: Load distribution using BGP metrics (MED) based on real-time system state.

How It Works:

• Health check scripts monitor system metrics (CPU, memory, connections)
• Calculate BGP MED based on current load
• Lower metric = more traffic, higher metric = less traffic
• Automatic traffic distribution across healthy nodes

Metric Strategies:

• Binary: Announce (metric 100) vs. Withdraw
• Gradual: Metrics 100-500 based on load percentage
• Multi-Service: Different metrics per service IP for balanced distribution

Example:

# Node 1: 60% CPU → MED 160
# Node 2: 40% CPU → MED 140 (receives more traffic)
# Node 3: 85% CPU → MED 185 (receives less traffic)

Applications:

• Web server pools
• Database read replicas (based on replication lag)
• API gateways (based on response time)
• Caching servers (based on cache hit rate)

4. Traffic Engineering and SDN Integration

Description: Programmatic BGP route injection for traffic steering and network optimization.

How It Works:

• SDN controller determines optimal paths
• Sends commands to ExaBGP via API
• ExaBGP announces routes with specific attributes
• Network devices route traffic accordingly

Use Cases:

• Path Optimization: Route traffic through optimal links
• Capacity Management: Balance traffic across multiple links
• Maintenance Windows: Gracefully drain traffic before maintenance
• Cost Optimization: Prefer less expensive transit paths
• BGP-LS Integration: Link-state information for SDN controllers

SDN Patterns:

• ExaBGP as BGP speaker for SDN controllers
• Segment Routing Traffic Engineering (SR-TE) with ExaBGP
• BGP-LS for topology discovery
• Integration with OpenFlow/P4 controllers

References:

• RIPE Labs: "ExaBGP - From BGP Route Injector to BGP Engine"
• BGP-SDN GitHub projects
• λBGP: Rethinking BGP programmability

5. Network Automation and Route Injection

Description: Automated route announcements based on application state and business logic.

How It Works:

• Application monitors its state (service health, capacity, license)
• Decides which routes to announce based on logic
• ExaBGP handles BGP protocol complexity
• Routes updated dynamically without manual intervention

Example Scenarios:

A. Service Discovery:

• New service instances register themselves via BGP
• Network automatically routes traffic to new instances
• Deregistration on shutdown

B. License-Based Routing:

• Announce premium routes only if license is valid
• Automatic route withdrawal on license expiration

C. Geographic Steering:

• Different routes announced from different regions
• AS path prepending for traffic steering

D. Blue/Green Deployments:

• Blue environment serves traffic (announces routes)
• Green environment deployed without announcement
• Switch traffic by changing BGP announcements

6. Network Blacklisting and Security

Description: Dynamic blackholing of malicious IPs at network edge.

How It Works:

• Security system identifies compromised/attacking IPs
• ExaBGP announces blackhole routes
• Edge routers drop traffic to/from blacklisted IPs
• Automatic expiration after specified time

Implementations:

• RTBH (Remote Triggered Black Hole): Announce with blackhole community
• FlowSpec: More granular filtering (specific ports/protocols)
• RPKI Integration: Route validation and filtering

Use Cases:

• Botnet C&C blocking
• Compromised host isolation
• Abuse mitigation
• Regulatory compliance (geo-blocking)

7. Cloud and Virtual Infrastructure

Description: BGP-based networking for cloud-native and virtual environments.

How It Works:

• Container/VM orchestration systems integrate with ExaBGP
• Services announce themselves as they scale
• Network provides dynamic routing without SDN overlay
• Native BGP for multi-cloud connectivity

Platforms:

• Kubernetes: BGP for pod networking (MetalLB alternative)
• AWS: BGP in VPCs, Direct Connect integration
• OpenStack: Neutron BGP dynamic routing
• Docker Swarm: Service mesh with BGP

Example - AWSnycast: Project using ExaBGP for anycast-style service discovery in AWS.

8. Protocol and Scale Testing

Description: BGP protocol testing, route injection at scale, and network simulation.

How It Works:

• ExaBGP simulates multiple BGP speakers from single host
• Injects large routing tables for testing
• Validates BGP implementation compliance
• Tests route convergence and stability

Capabilities:

• Scale: 450+ simultaneous BGP speakers from single machine
• Route Volume: Full internet routing table injection
• Protocol Testing: RFC compliance validation
• Interoperability: Multi-vendor BGP testing

Use Cases:

• Router performance testing
• Network design validation
• Capacity planning
• BGP security research

Integration Patterns

1. SIEM/Monitoring Integration

[SIEM/Monitoring] → [Detection Logic] → [ExaBGP API] → [BGP Network]
     (Splunk)          (Python/Go)         (STDIN)        (Routers)

2. Load Balancer Integration

[HAProxy/NGINX] → [Health Checks] → [ExaBGP] → [BGP] → [Edge Routers]
  (Backends)       (Python Script)    (Route)    (Update) (Traffic Fwd)

3. Orchestration Integration

[Kubernetes] → [Operator/Controller] → [ExaBGP] → [BGP] → [Network Fabric]
  (Services)     (Service Discovery)     (Routes)   (Dist)  (Pod Routing)

4. Database Integration

[DB Replicas] → [Lag Monitoring] → [ExaBGP] → [BGP] → [Read Traffic]
  (PostgreSQL)    (Metric Calc)      (MED)     (Dist)  (Distribution)

Technical Advantages

1. Pure Protocol Implementation

• No RIB/FIB manipulation
• Focuses on BGP protocol correctness
• 55+ RFCs implemented
• Vendor-neutral

2. Simple API

• STDIN/STDOUT communication
• Language-agnostic
• JSON and text encoders
• Easy integration

3. Lightweight

• Python-based (portable)
• Low resource usage (<50MB RAM typical)
• Single process or multiple speakers
• Runs on commodity hardware

4. Extensible

• External process model
• Custom health checks
• Arbitrary route attributes
• FlowSpec rule generation

5. Well-Documented

• 98 configuration examples
• Active community
• GitHub wiki
• Multiple blog articles and presentations

Industry Adoption

Companies Using ExaBGP

• Shutterstock (load balancing)
• LinkedIn (datacenter anycast)
• NSONE (anycasted DNS)
• Various ISPs and cloud providers (DDoS mitigation)
• Enterprise networks (high availability)

Conference Presentations

• RIPE: Multiple presentations on BGP control from applications
• UKNOF: BGP on the wire technical details
• LINX: FlowSpec and route injection
• UKUUG: Benefits of BGP for service providers
• SWINOG: DDoS blackholing in provider networks
• FRnOG: FlowSpec implementations

Comparison with Alternatives

ExaBGP vs. Traditional BGP Daemons (Quagga, BIRD, FRR)

Feature	ExaBGP	Traditional
RIB/FIB Manipulation	No	Yes
API-First Design	Yes	Limited
FlowSpec Support	Full	Partial/None
Programmability	Python/Any	Limited
Resource Usage	Low	Medium
Use Case	Application Control	Routing Daemon

ExaBGP vs. GoBGP

Feature	ExaBGP	GoBGP
Language	Python	Go
Performance	Good	Excellent
FlowSpec	Yes	Yes
Maturity	Mature (2010)	Newer (2014)
API	STDIN/STDOUT	gRPC
Community	Large	Growing

ExaBGP vs. Hardware SDN

Feature	ExaBGP	Hardware SDN
Cost	Open Source	Expensive
Deployment	Software Only	Hardware Required
Integration	Simple	Complex
Flexibility	High	Vendor-Locked
Learning Curve	Moderate	Steep

Configuration Examples (from etc/exabgp/)

ExaBGP includes 98 configuration examples covering:

1. Basic Examples: First BGP session, simple announcements
2. IPv4/IPv6: Unicast, multicast configurations
3. FlowSpec: DDoS mitigation, traffic filtering
4. L2VPN/L3VPN: VPLS, VPN configurations
5. API Integration: Python scripts, health checks
6. Advanced Features: Communities, AS-path manipulation
7. Operational: Maintenance, debugging, monitoring

Location: /main/etc/exabgp/ directory (to be indexed in wiki)

Best Practices

1. Architecture

• Use route servers for scalability
• Separate routing logic from route processing
• Configure service IPs on loopback interfaces
• Plan metric strategy carefully

2. Health Checks

• Implement retry logic (rise/fall counters)
• Set reasonable timeouts (2-5 seconds)
• Check all critical dependencies
• Support maintenance mode

3. Operations

• Monitor BGP session state
• Log all route changes
• Track failover events
• Alert on anomalies

4. Security

• Validate FlowSpec rules before injection
• Use authentication for BGP sessions
• Rate-limit API commands
• Audit route announcements

5. Testing

• Test health checks independently
• Validate failover scenarios
• Verify route filtering
• Load test at scale

Common Pitfalls

1. Forgetting to flush stdout: Commands not sent to ExaBGP
2. Incorrect next-hop: Routes not installed
3. Missing loopback configuration: Service IPs not reachable
4. No health check dampening: Route flapping
5. Insufficient logging: Hard to troubleshoot issues
6. No maintenance mode: Can't gracefully drain traffic
7. Overly sensitive health checks: False positives
8. Ignoring BGP timers: Slow failover

Performance Characteristics

• BGP Convergence: 5-15 seconds typical
• Health Check Interval: 5-10 seconds recommended
• Resource Usage: <50MB RAM, minimal CPU
• Scale: 1000+ routes per ExaBGP instance
• Speakers: 450+ simultaneous from single host
• FlowSpec Rules: Thousands supported (hardware-dependent)

Future Directions

Based on RIPE Labs articles:

1. IPv6 FlowSpec: Extended support for IPv6 flow specifications
2. Generalized Redirect: More flexible traffic redirection
3. Performance Optimization: Continued efficiency improvements
4. Additional RFC Support: Ongoing protocol implementation
5. Enhanced Monitoring: Better observability tools

Documentation Plan Integration

This summary informs the following wiki documents:

Tier 1 (Critical)

• Getting Started/Quick-Start.md: Basic anycast example
• API/API-Overview.md: STDIN/STDOUT pattern, encoders
• FlowSpec/FlowSpec-Overview.md: DDoS mitigation use case
• Use-Cases/High-Availability.md: Anycast and health checks
• Use-Cases/DDoS-Mitigation.md: FlowSpec implementation

Tier 2 (Important)

• Use-Cases/Load-Balancing.md: Metric-based distribution
• Use-Cases/Traffic-Engineering.md: SDN integration
• Use-Cases/Anycast-Services.md: DNS, web services
• Operations/Health-Checks.md: Implementation patterns
• Integration/SDN-Controllers.md: Controller integration

Tier 3 (Enhancement)

• Use-Cases/Network-Automation.md: Orchestration patterns
• Use-Cases/Cloud-Networking.md: AWS, Kubernetes
• Use-Cases/Security.md: Blackholing, RPKI
• Advanced/Performance-Testing.md: Scale testing

External Resources

Key Articles

1. Vincent Bernat - "High Availability with ExaBGP" (2013)
2. RIPE Labs - "ExaBGP: From Route Injector to BGP Engine"
3. thepacketgeek.com - ExaBGP Getting Started and Tutorials
4. Shutterstock Tech Blog - "Stop Buying Load Balancers"
5. Multiple conference presentations (RIPE, UKNOF, LINX, etc.)

GitHub Resources

1. Official ExaBGP repository with 98 examples
2. sysadminblog/exabgp-healthcheck
3. Community health check implementations
4. Integration examples (Kubernetes, AWS, etc.)

Commercial Tools

1. ExaCheck - Dedicated health checker for ExaBGP
2. Arbor SP/TMS - DDoS detection with FlowSpec
3. Wanguard - FlowSpec controller integration

Questions for Documentation Writers

When writing use case documentation:

1. Does this use case emphasize that ExaBGP doesn't manipulate RIB/FIB?
2. Is there a practical example from etc/exabgp/ referenced?
3. Does it cross-reference related documentation?
4. Is the health check implementation explained?
5. Are common errors and solutions included?
6. Is there a working code example?
7. Does it link to relevant RFCs?
8. Is the BGP protocol behavior explained?

Summary

ExaBGP's killer features:

• ✅ Only open-source FlowSpec implementation
• ✅ Simple API (STDIN/STDOUT)
• ✅ Pure protocol implementation (no RIB/FIB)
• ✅ 55+ RFCs supported
• ✅ Lightweight and portable
• ✅ Proven at scale (thousands of deployments)

Core use cases:

• 🎯 DDoS mitigation with FlowSpec
• 🎯 Anycast high availability
• 🎯 Dynamic load balancing
• 🎯 Traffic engineering
• 🎯 Network automation

Primary value proposition: Enables application-layer control of BGP without requiring deep BGP expertise or router access. Network engineers can implement sophisticated traffic control using simple Python scripts.

---

For Documentation Writers: This summary provides the comprehensive knowledge base for writing ExaBGP documentation. All use cases, patterns, and examples should reference this document for accuracy and consistency.