> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/netflow-ddos-detector/interface/smart-routing.md).

# Smart Routing

<figure><img src="/files/2FePulSyY352jW2d7QQW" alt=""><figcaption></figcaption></figure>

Smart Routing allows admins to define the conditions under which Link11 will automatically release traffic back to its original routing after an attack.

When an attack occurs, Link11 compares the targeted IP to the Smart Routing settings. The setting whose Prefix most closely matches the targeted IP will determine how the rerouting events are de-announced after the end of the attack.

{% hint style="info" %}
The end of an attack is determined by the absence of attack traffic against the originally targeted IP.&#x20;
{% endhint %}

Smart Routing settings can be defined broadly or narrowly, down to individual /32s. There are two default settings: `0.0.0.0/0` (for IPv4) and `::/0` (for IPv6). If the targeted IP does not match any other setting, the appropriate default is used.

{% hint style="info" %}
If route removal logic is disabled for a specific Prefix, and is not defined for the appropriate default settings (`0.0.0.0/0` or `::/0`), that Prefix's routes will need to be [removed manually in the Config section](/product-guides/netflow-ddos-detector/interface/config.md#rerouted).
{% endhint %}

**Example, based on the screenshot above**:

A DDoS attack triggering a reroute by targeting the IP 31.214.212.2 would be released using the settings in the third rule in the list, while an attack triggering a reroute by targeting the IP 31.214.212.34 would be released using the settings in the fourth rule. An attack triggering a reroute by targeting the IP 31.214.211.8 would be released using the settings in the second default rule (0.0.0.0/0).

***

## **Prefix**

The prefix that the route de-announcement settings will be based on. This represents the target IP or IPs. A single IP or a range of IPs (/24, /16, etc) can be added, with the most specific rule that includes the target being used.

<figure><img src="/files/mvRgFYxuKR0fKYOyRDk9" alt=""><figcaption></figcaption></figure>

***

## **Enable Automatic Route Removal**

This option is used to toggle off rules if needed.

<figure><img src="/files/gXZBYn29obqQK0pkmVw2" alt=""><figcaption></figcaption></figure>

***

## **Automatic Route Removal Cooldown**

Sets the timer at the end of an attack before the route is released. Routes can be removed manually from the [Rerouted](/product-guides/netflow-ddos-detector/interface/config.md#rerouted) section at anytime.

<figure><img src="/files/x5ZEmwRzeMqxNkb509II" alt=""><figcaption></figcaption></figure>

***

## **Automatic Cooldown Randomizer**

This options allows admins to add an optional random interval to the [Automatic Route Removal Cooldown](#automatic-route-removal-cooldown). Admins can choose a range for the random interval, and on each route removal, the amount of time added will be randomly selected from within the range.

<figure><img src="/files/flGd51VY6VERhfR8J9fw" alt=""><figcaption></figcaption></figure>

***

## **Automatic Route Removal Window**

Admins can choose to have routes released at a fixed time each day. (This can be helpful, to limit the impact route changes might have on customer traffic.) All routes will be released during the specified window.

Setting a Route Removal Window will take precedence over the Cooldown settings.

<figure><img src="/files/jJAsaytOt6aM1pQGnaZL" alt=""><figcaption></figcaption></figure>