After you switch your service traffic to an Anti-DDoS Pro or Anti-DDoS Premium instance, you can view the metrics and DDoS attack events in real time on the Security Overview page in the relevant console.

Prerequisites

An Anti-DDoS Pro or Anti-DDoS Premium instance is purchased and your service is protected by the instance.

Background information

Notice In the top navigation bar of the Anti-DDoS Pro or Anti-DDoS Premium console, you can switch the region (Mainland China and Outside Mainland China), and the system switches between Anti-DDoS Pro and Anti-DDoS Premium accordingly for you to manage and configure Anti-DDoS Pro or Premium instances. Ensure that you switch to the required region when you use Anti-DDoS Pro or Anti-DDoS Premium.

The Security Overview page provides an overview of the following metrics and DDoS attack events:

  • Service metrics: clean bandwidth, QPS, connections per second (CPS), protected domain names, and protected ports.
  • Attack events: volumetric DDoS attacks, connection-oriented attacks, and resource exhaustion attacks.

Procedure

  1. Log on to the Anti-DDoS Pro console.
  2. In the top navigation bar, select the region of your Anti-DDoS instance.
    • Mainland China: Anti-DDoS Pro
    • Outside Mainland China: Anti-DDoS Premium
  3. In the left-side navigation pane, click Security Overview.
  4. Optional:Turn on Traffic Flow Diagram to view the background information and concepts.
    Traffic Flow Diagram displays the relationship between origin servers and Anti-DDoS Pro or Anti-DDoS Premium instances, the terminology, and commonly used units.Security overview
  5. Click the Instances tab, select one or more instances, and specify a time range to view the relevant metrics.Instances tab
    You can view the following instance information:
    • Peak Attack Bandwidth and Peak Attack Packet Rate
    • Traffic trends
      • The Bandwidth trend chart provided by Anti-DDoS Pro displays the traffic information by bps or pps. You can view the trends of inbound, outbound, and attack traffic of an instance for a specific period of time.Bandwidth trends
      • Anti-DDoS Premium provides the following tabs to provide bandwidth trends, distribution of inbound traffic, and distribution of outbound traffic, respectively: Overview, Inbound Distribution, and Outbound Distribution.Trend of inbound traffic
    • Attack Events of blackhole and mitigation
      You can move the pointer over an IP address or a port to view the details of an attack, such as Attack Target, Attack Type, Peak Attack Traffic, and Protection Effect.Attack events
    • Connections on a port
      • Concurrent Connections: the total number of concurrent TCP connections established between clients and the instance
      • New Connections: the number of new TCP connections established between clients and the instance per second
      Note If you select an instance, the Connections chart displays the numbers of connections on different ports. If you select multiple instances, the total number of connections of ports are displayed.
      Connections
    • The distribution of traffic by Source Locations and Source Service Providers
  6. Click the Domains tab, select one or more domains, and specify a time range to view the relevant metrics.Domains tab
    You can view the following domain information:
    • Peak HTTP Attack Traffic and Peak HTTPS Attack Traffic
    • Requests
      The trend of requests is displayed based on the peak values in a specific time range. The displayed time granularity is based on the specific time range:
      • If the time range is less than an hour, the granularity is 1 minute.
      • If the time range is between 1 and 6 hours, the granularity is 10 minutes.
      • If the time range is between 6 and 24 hours, the granularity is 30 minutes.
      • If the time range is between 1 and 7 days, the granularity is 1 hour.
      • If the time range is between 7 and 15 days, the granularity is 4 hours.
      • For larger time ranges, the granularity is 12 hours.
    • Attack Events
      You can move the pointer over a domain to view the details of an attack, such as Domains, Peak Attack Traffic, and Attack Type.Attack events
    • Response Codes
      The trend chart of response codes displays the accumulated numbers of response codes within a specific time range. This time range is the same as that specified in the Requests chart. You can move the pointer over the question mark icon to view the explanation of response codes.Response codes
    • Source Locations
    • Most Requested URIs and Slow Loading URIs
    • Cache Hit Rate
      Note You must enable the static page caching feature before you can view the trend chart of the cache hit rate. For more information, see Configure static page caching rules.