Query the usage details of your Anti-DDoS Native 2.0 instance from the Billing Center.
Usage notes
When you use the multi-account management feature, you can query information such as usage details of public IP assets under member accounts only by using the management account. You cannot query the information by using a member account. For more information, see Multi-account management.
Pay-as-you-go instances
Query the usage details of a pay-as-you-go instance
Go to the Billing Management page of the Traffic Security console.
On the Pay-as-you-go Instances tab, view the usage overview and details for the current month.
Usage details
Description
Feature activation
You are billed based on the number of days the feature is enabled. The fee varies based on the region where your protected assets are deployed.
Number of protected IP addresses
The count includes protected IP addresses of regular Alibaba Cloud services and Anti-DDoS Advanced EIPs.
You are charged based on tiered pricing according to the number of protected asset IP addresses.
The IP usage on day T is calculated on day T+1. The value is the number of IP addresses at approximately 23:00 (UTC+8) on day T.
When you use the multi-account management feature, the number of protected IP addresses under the current Alibaba Cloud account and under member accounts is displayed separately.
Clean traffic
Clean traffic is the normal service traffic generated on Alibaba Cloud services. Attack traffic is excluded. You can query the actual traffic usage and the billed usage on a specified date, and view more detailed traffic data by region and by asset IP address. For details, see the Query the traffic usage of a pay-as-you-go instance section below.
To simplify and standardize billing, traffic metering data comes from Alibaba Cloud services and uses the larger value between outbound traffic and inbound traffic.
Regular Alibaba Cloud services and Anti-DDoS Advanced EIPs have different unit prices and are billed separately.
Traffic in the Chinese mainland and traffic outside the Chinese mainland are charged based on separate tiered pricing.
The clean traffic usage on day T is calculated on day T+1.
When you use the multi-account management feature, the traffic of protected IP assets under the current Alibaba Cloud account and under member accounts is displayed separately.
Query the traffic usage of a pay-as-you-go instance
Traffic measurement uses a minimum traffic mechanism. If the daily traffic does not exceed the daily minimum traffic, the fee is calculated based on the daily minimum traffic.
Asset type | Asset IP region | Asset IP count range | Daily minimum traffic per IP |
Regular Alibaba Cloud service | Chinese mainland | No minimum traffic mechanism applies. The actual service traffic prevails. | |
Outside the Chinese mainland | |||
Anti-DDoS Advanced EIP | Chinese mainland | IP count ≤ 30 | 0 GB |
31 ≤ IP count ≤ 99 | 20 GB | ||
IP count ≥ 100 | 40 GB | ||
Outside the Chinese mainland | No minimum traffic mechanism applies. The actual service traffic prevails. | ||
Example 1: You protect 32 Anti-DDoS Advanced EIP assets. Among them, 12 IP addresses generate 10 GB of traffic each per day and 20 IP addresses generate 15 GB of traffic each per day.
The measured daily traffic bill is 32 × 20 = 640 GB.
Example 2: You protect 32 Anti-DDoS Advanced EIP assets. Among them, 12 IP addresses generate 30 GB of traffic each per day and 20 IP addresses generate 15 GB of traffic each per day.
The measured daily traffic bill is 30 × 12 + 20 × 20 = 760 GB.
Go to the Billing Management page of the Traffic Security console.
On the Pay-as-you-go Instances tab, view the traffic usage of regular Alibaba Cloud services and Anti-DDoS Advanced EIPs.
Data description:
The billed traffic usage of your protected assets for the current month. You can also view the data by region.
The billed traffic usage on a specified date.
The actual traffic usage and billed usage on a specified date. You can also view more detailed traffic data by region and by asset IP address.
Regional usage distribution: In the Usage by Region column, click Details to view the actual traffic usage by region.
Asset usage distribution: In the Usage by Asset column, click Details to view the actual traffic usage and billed usage by asset IP address. Below the Usage by Asset tab, click Export to export all asset usage distribution data. The default format is xlsx.
Bandwidth limits of Anti-DDoS Advanced EIPs
Bandwidth limits apply only to Anti-DDoS Advanced EIPs. Regular Alibaba Cloud services are not limited. The following bandwidth limits vary based on the region of the protected public IP assets. Click Details to apply for an adjustment to the peak access bandwidth.
Peak inbound bandwidth for local region access: This applies when your clients and the Anti-DDoS Advanced EIP are in the same region. If both are outside the Chinese mainland, the peak inbound bandwidth cannot exceed 2 Gbps. If both are in the Chinese mainland, the peak inbound bandwidth cannot exceed 20 Gbps.
Peak inbound bandwidth for cross-region access: This applies when your clients and the Anti-DDoS Advanced EIP are in different regions. If the Anti-DDoS Advanced EIP is outside the Chinese mainland, the peak inbound bandwidth cannot exceed 100 Mbps. If the Anti-DDoS Advanced EIP is in the Chinese mainland, the peak inbound bandwidth is unlimited.
Go to the Billing Management page of the Traffic Security console.
On the Pay-as-you-go Instances tab, view the traffic usage of Anti-DDoS Advanced EIPs for the current month.
The following bandwidth limits vary based on the region of the protected public IP assets. In the upper-right corner of the Billing Management page, click Details to apply for an adjustment to the peak access bandwidth. In the lower-right corner of the page, the Instance Quota section shows the clean bandwidth quota (inbound) of Anti-DDoS Advanced EIPs: the peak inbound bandwidth for local region access is 2 Gbps (outside the Chinese mainland) or 20 Gbps (in the Chinese mainland), and the peak inbound bandwidth for cross-region access is 100 Mbps (outside the Chinese mainland) or unlimited (in the Chinese mainland).
Subscription instances
Query alerts on exceeded upper limits
Procedure
Go to the Billing Management page of the Traffic Security console.
On the Subscription Instances tab, select Alerts on Exceeded Upper Limits. Alternatively, in the Actions column, click View to view the overall trends of the inbound clean bandwidth, outbound clean bandwidth, and baseline clean bandwidth.
Usage notes
You can query alerts on exceeded upper limits for up to the last 30 days.
Anti-DDoS Native allows service traffic peaks to exceed the instance bandwidth for a short period. When the cumulative overuse duration in a month reaches 1 hour, 9 hours, 18 hours, 27 hours, or 36 hours, the system sends a reminder through Message Center the next morning (T+1). When the cumulative overuse duration reaches 36 hours, the Anti-DDoS Native mitigation capabilities become invalid, and only the basic protection capabilities of Anti-DDoS Basic are retained. For more information, see Bandwidth limit and overage recovery.
Query burstable clean bandwidth usage
Starting from 10:00 on May 28, 2026, Anti-DDoS Native no longer supports the Monthly 95th Percentile billing mode for burstable clean bandwidth. The Daily 95th Percentile feature is enabled by default for new and existing users. You can no longer manually adjust burstable clean bandwidth settings in the console (disable or enable the feature, change the billing mode, or change the bandwidth specification). For more information, see [Important] Adjustments to Anti-DDoS burstable billing feature.
Go to the Billing Management page of the Traffic Security console.
On the Subscription Instances tab, select Daily 95th Percentile or Monthly 95th Percentile. Alternatively, in the Actions column, click View to view details such as the total traffic peak value.
Billing mode
Data description
Daily 95th Percentile
Total traffic peak value: Within a calendar day, the service traffic peak is sampled at 5-minute intervals to produce 288 values per day. Values recorded during DDoS attacks are excluded, then the top 5 values are excluded, and the maximum of the remaining values is used.
Portion above the baseline bandwidth: Total traffic peak value - baseline clean bandwidth.
95th percentile billing bandwidth: min(total traffic peak value, total clean bandwidth) - baseline clean bandwidth. The total clean bandwidth is 5 times the baseline clean bandwidth.
Monthly 95th Percentile
Total traffic peak value: Calculated as follows.
Get the daily bandwidth peak: Within a calendar day, the service traffic peak is sampled at 5-minute intervals to produce 288 values per day. Values recorded during DDoS attacks are excluded, and the maximum of the remaining values is used.
Calculate the total traffic peak value: Sort the daily bandwidth peaks within a calendar month in descending order and calculate the average of the top 5 values. The result is the total traffic peak value.
Portion above the baseline bandwidth: Total traffic peak value - baseline clean bandwidth. The baseline clean bandwidth is the value on the last day of the current month when burstable clean bandwidth was enabled.
95th percentile billing bandwidth: min(total traffic peak value, total clean bandwidth) - baseline clean bandwidth.
Total clean bandwidth: Take the baseline clean bandwidth values that correspond to the top 5 daily bandwidth peaks and use the maximum of them. The total clean bandwidth is 5 times that maximum.
Baseline clean bandwidth: The baseline clean bandwidth on the last day of the current month when burstable clean bandwidth was enabled.
References
For the specific fees of each usage item of an Anti-DDoS Native 2.0 instance, see Anti-DDoS Native 2.0 (Subscription) and [Existing customers] Anti-DDoS Native 2.0 (Pay-as-you-go).