> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/using-link11/api/netflow-ddos-detector.md).

# Netflow DDoS Detector

The Netflow DDoS Detector API allows admins to trigger BGP Announcements for specific /24s.

{% hint style="info" %}
The information below assumes you have already the [Introduction to the Link11 API](/using-link11/api/introduction.md).
{% endhint %}

## Service Key definition

`apikey=infraddos`

## Domain Key definition <a href="#id-customerapi-webddos-webddoscommands" id="id-customerapi-webddos-webddoscommands"></a>

For the commands that include a Domain Key (referred to below as $DOMAINKEY), use the [API Key for the instance from WebGUI](broken://pages/VUDuLHzvFgR0480bepBo).

***

## API Commands <a href="#id-customerapi-cloudinsights-routeannouncement" id="id-customerapi-cloudinsights-routeannouncement"></a>

### **Trigger Reroute**

`https://api.link11.de/?apikey=infraddos&domainkey=[$DOMAINKEY]&trigger_reroute&ip=[IP Address]&bgp_session_uuid=[BGP Session UUID(s)]&auto_withdrawal=[UNIX Timestamp]`

| Parameter          | Description                                                                                                                                                                                | Example                              |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------ |
| domainkey          | The customer API passcode provided by Link11. This value is used for both Netflow DDoS Detector and Network DDoS API calls                                                                 | ed76dd7e490f3f2e5afb9ddd848301ef     |
| IP                 | The IP address as a /32 that should be rerouted. Link11 will announce the /24 that contains this /32                                                                                       | 31.214.212.3                         |
| bgp\_session\_uuid | The IDs of the BGP session or sessions that should be used when announcing the prefix. This can be obtained in WebGUI by expanding an entry in the **Network DDoS / BGP Sessions** window. | 699178b7-9tba-42f0-rf02-753037532b53 |
| auto\_withdrawal   | Unix timestamp in UTC determining the time this route should be withdrawn                                                                                                                  | 1693551600                           |

#### **Response**

When a reroute was successfully triggered:

```
{
  "data" : [
  {
    "announced_prefix" : "31.214.212.0/24",
    "auto_withdrawal_time" : null,
    "bgp_session_name" : "session446",
    "bgp_session_uuid" : "699178b7-9aba-42f0-bf02-753037332b51",
    "message" : "rerouting triggered",
    "status" : "success"
  }
  ],
  "return_code" : 200,
  "return_text" : "OK"
}
```

When a reroute is already in place:

```
{
  "data" : [
  {
    "announced_prefix" : "31.214.212.0/24",
    "auto_withdrawal_time" : null,
    "bgp_session_name" : "session446",
    "bgp_session_uuid" : "699178b7-9aba-42f0-bf02-753037332b51",
    "message" : "The prefix is already rerouted.",
    "status" : "info"
  }
  ],
  "return_code" : 200,
  "return_text" : "OK"
}
```

### **Get Reroute Status**

`https://api.link11.de/?apikey=infraddos&domainkey=[$DOMAINKEY]&get_reroute_status&ip=[IP Address]&bgp_session_uuid=[BGP Session UUID]`

| Parameter          | Description                                                                                                                                                                                | Example                              |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------ |
| domainkey          | The customer API passcode provided by Link11. This value is used for both Netflow DDoS Detector and Network DDoS API calls                                                                 | ed76dd7e490f3f2e5afb9ddd848301ef     |
| IP                 | The IP address as a /32 that should be rerouted. Link11 will announce the /24 that contains this /32.                                                                                      | 31.214.212.3                         |
| bgp\_session\_uuid | The IDs of the BGP session or sessions that should be used when announcing the prefix. This can be obtained in WebGUI by expanding an entry in the **Network DDoS / BGP Sessions** window. | 699178b7-9tba-42f0-rf02-753037532b53 |

#### **Response**

When prefix has not yet been rerouted:

```
{
  "data" : [
  {
    "bgp_session_name" : "session446",
    "bgp_session_uuid" : "699178b7-9aba-42f0-bf02-753037332b51",
    "prefix" : "31.214.212.0/24",
    "status" : "not rerouted"
  }
  ],
  "return_code" : 200,
  "return_text" : "No BGP sessions rerouted.",
  "status" : "success"
}
```

When prefix has been rerouted:

```
{
  "data" : [
  {
    "bgp_session_name" : "session446",
    "bgp_session_uuid" : "699178b7-9aba-42f0-bf02-753037332b51",
    "prefix" : "31.214.212.0/24",
    "status" : "rerouted"
  }
  ],
  "return_code" : 200,
  "return_text" : "BGP session(s) successfully rerouted.",
  "status" : "rerouted"
}
```