Fields in the logs of Anti-DDoS Native - Anti-DDoS - Alibaba Cloud Documentation Center

Anti-DDoS Native logs contain two categories of fields. Event fields record state changes such as the start or end of a scrubbing session or the activation of blackhole filtering. Traffic scrubbing fields record packet-level statistics for what each mitigation policy allowed or denied during a scrubbing session.

Event fields

Event logs are generated when a protected asset experiences a state change: a scrubbing session begins or ends, or blackhole filtering is activated or lifted.

Field	Description	Example value
`data_type`	The data type. Valid values:`Global_SC_Detection` (traffic forwarded by the Anti-DDoS Proxy scrubbing center, protected by a diversion instance), `Global_SC_Mitigation` (traffic scrubbed by the Anti-DDoS Proxy scrubbing center, protected by a diversion instance), `Regional_SC_Detection` (inbound traffic in the region where Alibaba Cloud assets reside), `Regional_SC_Mitigation` (scrubbed traffic in the region where Alibaba Cloud assets reside), `event` (attack event data).	`Regional_SC_Mitigation`
`event_time`	Time of the event, as a UNIX timestamp. Unit: seconds.	`1624434027`
`event_type`	The event type. Valid values:`mitigation_begin` (a traffic scrubbing event begins), `mitigation_ended` (a traffic scrubbing event ends), `blackhole_begin` (a blackhole filtering event begins), `blackhole_ended` (a blackhole filtering event ends).	`mitigation_begin`
`instance_id`	ID of the Anti-DDoS Native instance.	`ddosbgp-cn-n6w203qg****`
`ip`	IP address of the protected asset.	`39.XX.XX.23`
`kbps_in`	Inbound traffic bandwidth. Unit: Kbit/s.	`1000`
`new_con`	Number of new connections.	`1000`
`pps_in`	Inbound packet forwarding rate. Unit: packets per second.	`1000`
`qps`	Queries per second (QPS).	`1000`
`scrubbing_center`	The region of the scrubbing center. Valid values:`us_west` (US (Virginia)), `us_east` (US (Silicon Valley)), `frankfurt` (Germany (Frankfurt)), `hk` (China (Hong Kong)), `singapore` (Singapore), `malaysia` (Malaysia (Kuala Lumpur)), `uk` (UK (London)), `japan` (Japan (Tokyo)), `total_summary` (all regions), `assets_base_region` (the region where the asset resides).	`us_west`
`subnet`	CIDR block used for traffic rerouting.	`1.XX.XX.1/24`
`uid`	ID of the Alibaba Cloud account.	`170457416359****`

Traffic scrubbing fields

Traffic scrubbing logs record packet statistics for each scrubbing session. Each entry captures traffic at a point in time for a specific destination IP address and port. Fields are organized into three groups: overall traffic totals, per-protocol breakdowns, and per-policy allow and deny counts.

Overall traffic

Field	Description	Example value
`time`	Time at which the log entry was generated, as a UNIX timestamp. Unit: seconds.	`1624434027`
`destination_ip`	Destination IP address.	`123.XX.XX.169`
`port`	Destination port. `all` (default) covers all ports. A specific value such as `80` covers that port only.	`80`
`total_traffic_in_bps`	Total bytes per second of all inbound packet types reaching the scrubbing center. Unit: bytes per second.	`8000`
`total_traffic_drop_bps`	Total bytes per second of all packet types that were discarded. Unit: bytes per second.	`800`
`total_traffic_in_pps`	Forwarding rate of all inbound packet types. Unit: packets per second.	`1000`
`total_traffic_drop_pps`	Forwarding rate of all discarded packet types. Unit: packets per second.	`1000`

Per-protocol traffic

These fields break down inbound and discarded traffic by protocol or TCP flag type.

Field	Description	Example value
`pps_types_in_tcp_pps`	Forwarding rate of inbound TCP packets. Unit: packets per second.	`100`
`pps_types_in_udp_pps`	Forwarding rate of inbound UDP packets. Unit: packets per second.	`1000`
`pps_types_in_icmp_pps`	Forwarding rate of inbound ICMP packets. Unit: packets per second.	`1000`
`pps_types_in_syn_pps`	Forwarding rate of inbound SYN packets. Unit: packets per second.	`1000`
`pps_types_in_ack_pps`	Forwarding rate of inbound ACK packets. Unit: packets per second.	`1000`
`pps_types_in_synack_pps`	Forwarding rate of inbound SYN-ACK packets. Unit: packets per second.	`1000`
`pps_types_in_finrst_pps`	Forwarding rate of inbound FIN or RST packets. Unit: packets per second.	`1000`
`pps_types_in_dns_pps`	Forwarding rate of inbound DNS packets. Unit: packets per second.	`1000`
`pps_types_drop_tcp_pps`	Forwarding rate of discarded TCP packets. Unit: packets per second.	`1000`
`pps_types_drop_udp_pps`	Forwarding rate of discarded UDP packets. Unit: packets per second.	`1000`
`pps_types_drop_icmp_pps`	Forwarding rate of discarded ICMP packets. Unit: packets per second.	`1100`
`pps_types_drop_syn_pps`	Forwarding rate of discarded SYN packets. Unit: packets per second.	`1000`
`pps_types_drop_ack_pps`	Forwarding rate of discarded ACK packets. Unit: packets per second.	`1000`
`pps_types_drop_synack_pps`	Forwarding rate of discarded SYN-ACK packets. Unit: packets per second.	`1000`
`pps_types_finrst`	Forwarding rate of discarded FIN or RST packets. Unit: packets per second.	`1000`
`pps_types_dns`	Forwarding rate of discarded DNS packets. Unit: packets per second.	`1000`

Per-policy traffic

Each field records the forwarding rate of traffic that a specific mitigation policy allowed or denied.

Packet checking

Field	Description	Example value
`policy_packet_checking_acct_pps`	Packets allowed by the default packet checking policy. Unit: packets per second.	`1000`
`policy_packet_checking_drop_pps`	Packets denied by the default packet checking policy. Unit: packets per second.	`1000`

Source IP address-based authentication

Field	Description	Example value
`policy_source_ip_authentication_checked_pps`	Packets currently being checked by the default source IP address-based authentication policy. Unit: packets per second.	`1000`
`policy_source_ip_authentication_succeed_pps`	Packets that passed the default source IP address-based authentication policy check. Unit: packets per second.	`1000`
`policy_source_ip_authentication_acct_pps`	Packets allowed by the default source IP address-based authentication policy. Unit: packets per second.	`1000`
`policy_source_ip_authentication_drop_pps`	Packets denied by the default source IP address-based authentication policy. Unit: packets per second.	`1000`

Source IP address-based rate limiting

Field	Description	Example value
`policy_source_ip_rate_limitation_drop_syn_pps`	SYN packets denied by the default source IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_source_ip_rate_limitation_drop_con_max_pps`	Packets denied because the number of concurrent connections from the source IP address exceeded the limit set by the default source IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_source_ip_rate_limitation_drop_con_rate_pps`	Packets denied because the connection rate from the source IP address exceeded the limit set by the default source IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_source_ip_rate_limitation_drop_udp_rate_pps`	UDP packets denied by the default source IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_source_ip_rate_limitation_drop_tcpack_rate_pps`	ACK packets denied by the default source IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_source_ip_rate_limitation_drop_tcpsynack_rate_pps`	SYN-ACK packets denied by the default source IP address-based rate limiting policy. Unit: packets per second.	`1000`

Destination IP address-based rate limiting

Field	Description	Example value
`policy_destination_ip_rate_limitation_drop_syn_rate`	SYN packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_destination_ip_rate_limitation_drop_udp_rate`	UDP packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_destination_ip_rate_limitation_drop_ack_rate`	ACK packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_destination_ip_rate_limitation_drop_icmp_rate`	ICMP packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_destination_ip_rate_limitation_drop_synack_rate`	SYN-ACK packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second.	`1000`
`policy_destination_ip_rate_limitation_drop_other_rate`	Packets denied by the default destination IP address-based rate limiting policy, excluding UDP, ICMP, SYN, SYN-ACK, and ACK packets. Unit: packets per second.	`1000`

Fingerprint filtering

Fingerprint filtering policies can be customized in Mitigation Settings.

Field	Description	Example value
`policy_layer_4_filter_l4_filiter_drop_pps`	Packets denied by all fingerprint filtering policies combined. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filiter_acct_num`	Packets allowed by all fingerprint filtering policies combined. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_1_pps`	Packets denied by the first fingerprint filtering policy. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_2_pps`	Packets denied by the second fingerprint filtering policy. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_3_pps`	Packets denied by the third fingerprint filtering policy. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_4_pps`	Packets denied by the fourth fingerprint filtering policy. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_5_pps`	Packets denied by the fifth fingerprint filtering policy. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_6_pps`	Packets denied by the sixth fingerprint filtering policy. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_7_pps`	Packets denied by the seventh fingerprint filtering policy. Unit: packets per second.	`1000`
`policy_layer_4_filter_l4_filite_drop_rule_8_pps`	Packets denied by the eighth fingerprint filtering policy. Unit: packets per second.	`1000`

First-packet-dropping (TCP)

Field	Description	Example value
`policy_retransmission_authentication_acct_pps`	Packets allowed by the default first-packet-dropping policy. Unit: packets per second.	`1000`
`policy_retransmission_authentication_drop_pps`	Packets denied by the default first-packet-dropping policy. Unit: packets per second.	`1000`

First-packet-dropping (DNS)

Field	Description	Example value
`policy_dns_retransmission_authentication_acct_pps`	Packets allowed by the default first-packet-dropping policy for domain names. Unit: packets per second.	`100`
`policy_dns_retransmission_authentication_drop_pps`	Packets denied by the default first-packet-dropping policy for domain names. Unit: packets per second.	`1000`

Domain-based authentication

Field	Description	Example value
`policy_dns_domain_authentication_succ_domain_pps`	Packets that passed the default domain-based authentication policy check. Unit: packets per second.	`1000`
`policy_dns_domain_authentication_fail_domain_pps`	Packets that failed the default domain-based authentication policy check. Unit: packets per second.	`1000`
`policy_dns_domain_authentication_acct_pps`	Packets allowed by the default domain-based authentication policy. Unit: packets per second.	`1000`
`policy_dns_domain_authentication_drop_pps`	Packets denied by the default domain-based authentication policy. Unit: packets per second.	`1000`

SYN cookie

Field	Description	Example value
`policy_syn_cookie_succ_check_pps`	Packets that passed the default SYN cookie-based policy check. Unit: packets per second.	`1000`
`policy_syn_cookie_fail_check_pps`	Packets that failed the default SYN cookie-based policy check. Unit: packets per second.	`1000`
`policy_syn_cookie_rebound_check_pps`	Packets redirected for verification by the default SYN cookie-based policy. Unit: packets per second.	`1000`
`policy_syn_cookie_acct_pps`	Packets allowed by the default SYN cookie-based policy. Unit: packets per second.	`1000`
`policy_syn_cookie_drop_pps`	Packets denied by the default SYN cookie-based policy. Unit: packets per second.	`1000`

UDP protection

Field	Description	Example value
`policy_udp_defense_in_pps`	Inbound UDP packets matched by the default UDP protection policy per second. Unit: packets per second.	`1000`
`policy_udp_defense_drop_pps`	Packets denied by the default UDP protection policy. Unit: packets per second.	`1000`

DNS protection

Field	Description	Example value
`policy_dns_ipdomain_rate_limitation_drop_over_rate_limitation_pps`	Packets discarded because IP address or domain name rate limits were triggered under the default DNS protection policy. Unit: packets per second.	`1000`

TCP protection

Field	Description	Example value
`policy_antitcp_in_pps`	Total rate of TCP packets that matched the TCP protection policy. Unit: packets per second.	`1000`
`policy_antitcp_drop_tcp_pps`	All TCP packets denied by the default TCP protection policy. Unit: packets per second.	`1000`
`policy_antitcp_drop_ack_pps`	ACK packets denied by the default TCP protection policy. Unit: packets per second.	`1000`
`policy_antitcp_drop_pushack_pps`	PUSHACK packets denied by the default TCP protection policy. Unit: packets per second.	`1000`
`policy_antiothertcp_session_cre_num_syn_pps`	Rate of sessions created by the TCP protection policy using SYN packets. Unit: packets per second.	`1000`
`policy_antiothertcp_session_cre_num_ack_pps`	Rate of sessions created by the TCP protection policy using ACK packets. Unit: packets per second.	`1000`
`policy_antiothertcp_succ_auth_num_syn_pps`	Rate of packets authenticated after a session was created by the TCP protection policy using SYN. Unit: packets per second.	`1000`
`policy_antiothertcp_succ_auth_num_ack_pps`	Rate of packets authenticated after a session was created by the TCP protection policy using ACK. Unit: packets per second.	`1000`
`policy_antiothertcp_acct_pps`	Packets allowed by other default TCP protection policies. Unit: packets per second.	`1000`
`policy_antiothertcp_drop_pps`	Packets denied by other default TCP protection policies. Unit: packets per second.	`1000`