Elastic IP Address:FAQ about billing

• The remaining amount is refunded after the switch.

  Only the actually paid amount is refunded with the original payment method. For more information, see Request a refund after the change of the billing method from subscription to pay-as-you-go.

• After the switch, the pay-as-you-go (pay-by-bandwidth) EIP is billed based on the amount of consumed resources.

  Pay-as-you-go (pay-by-bandwidth) EIP fee = Bandwidth fee + EIP configuration fee (public IP retention fee).

Example: Alice has a subscription EIP whose line type is BGP (Multi-ISP) and maximum bandwidth is 300 Mbit/s in the China (Beijing) region. The EIP is not associated with a resource. Alice switches the billing method of the EIP from subscription to pay-as-you-go (pay-by-bandwidth) at 08:15:0) on November 20, 2024. After the switch, Alice releases the EIP at 22:30:00 on November 20, 2024. In this case, Alice will receive a bill on November 21, 2024. The fee of the pay-as-you-go EIP on November 20, 2024 is calculated based on the following rules:EIPEIP

• Billing rules for pay-as-you-go EIP:

  • After your application for an EIP is approved, you are immediately charged an EIP configuration fee (public IP retention fee). You are not charged an EIP configuration fee (public IP retention fee) if the EIP is allocated from a specific IP address pool.

  • When the EIP is associated with a resource, you are not charged an EIP configuration fee (public IP retention fee) only if the EIP is directly associated with an Elastic Compute Service (ECS) instance in a virtual private cloud (VPC) or an elastic container instance and the number of EIP that your Alibaba Cloud account can own does not exceed 2,000.

  To prevent unnecessary fees, we recommend that you apply for EIPs only when you need to use them.

• If you use a subscription EIP, you are not charged an EIP configuration fee (public IP retention fee).

Traffic spikes on EIPs can cause increases in EIP data transfer fees. Troubleshooting methods:

Cause

• Business-related causes: system updates or traffic increases caused by business growth.

• System vulnerabilities: application errors generate a large number of requests.

• Attacks or scanning: unauthorized access from attacks, crawlers, and other sources causes increases in data transfers.

• Improper network configurations: improper security group or firewall configurations allow a large number of unexpected requests.

Troubleshooting procedure

1. View the monitoring data

   Log on to the CloudMonitor console and view the data transfers and bandwidth usage of your EIP. Analyze the error trend based on the monitoring data. For more information, see the "View the monitoring data of an EIP" section of Monitoring and alerting.

   In addition, you can take the following measures to facilitate error locating:

   • Configure fine-grained monitoring to monitor traffic fluctuations in real time and adjust the maximum bandwidth of EIP as needed.

   • View traffic statistics to learn about the rankings of data transfers between an EIP and external IP addresses.

   • Create an alert rule for bandwidth usage to trigger alerts when anomalies in bandwidth usage are detected. This measure helps you quickly locate and handle anomalies.

2. Locate the abnormal process

   • CloudMonitor: Use the process monitoring feature of CloudMonitor to locate abnormal processes during the time range in which traffic spikes are detected. For more information, see Process monitoring.

   • Network monitoring utilities: Use a suitable monitoring utility based on the operating system used by the server associated with the EIP to locate processes that occupy a large amount of network resources.

     • Linux: You can use sar, iftop, and nethogs to view the network traffic load on an ECS instance. For more information, see Troubleshoot high network bandwidth usage of Linux instances.

     • Windows: You can use the built-in utilities of Microsoft, such as Task Manager, Resource Monitor, Performance Monitor, Process Explorer, and Xperf (supported by Windows Server 2008 and later) to analyze resource usage. For more information, see What do I do if a Windows instance has high network bandwidth utilization?

3. Analyze log data

   View the log data of the server to identify traffic sources and request types.

   Sample command for query server logs

   Query logs of a Linux server

   • Query the NGINX access log: cat /var/log/nginx/access.log

   • Query the Apache access log: cat /var/log/apache2/access.log

   Query logs of a Windows server

   The path of the access log on an NGINX or Apache server varies based on the installation and configuration methods.

   • If the path of the NGINX access log is C:\Program Files\nginx\logs\access.log, use the following command: type C:\Program Files\nginx\logs\access.log.

   • If the path of the Apache access log is C:\Program Files\Apache Software Foundation\Apache2.4\logs, use the following command: type C:\Program Files\Apache Software Foundation\Apache2.4\logs\access.log.

4. Check the security group and firewall configurations

   Check the configurations of the security group and firewall. Make sure that idle ports and services are disabled to enhance access control.

   For information about how to configure a security group rule, see Add security group rules. If you require tailored or finer-grained access control, add the following firewall configurations:

   • Firewall for Linux servers: Block untrusted IP addresses and ports

     # View the firewall rules (iptables).
     sudo iptables -L -n -v
     # Add Firewall rules to block untrusted IP addresses and ports.
     sudo iptables -A INPUT -s <suspicious-ip> -j DROP

   • Firewall for Windows servers: Configure firewall rules on the Windows Defender page.

5. Check the processes

   Use anti-virus software or security tools to check for malicious software and vulnerabilities on the servers and update the system and software in a timely manner.

   You can use Security Center to detect and block security threats, including viruses, attacks, ransomware, vulnerabilities, AccessKey leaks, and mining.