Anti-DDoS:Event Center for Anti-DDoS Basic

Procedure

1. Log on to the Traffic Security console. In the left-side navigation pane, choose DDoS.

2. In the left-side navigation pane, click Event Center.

3. At the top of the page, set the time range of Attack Start Time. You can select a preset time range, such as Last 30 Days, or specify a custom start date and end date. The page contains the following sections:

   • Ongoing: indicates whether an attack event is in progress and shows its protection status. If no event is in progress, this section displays the security status, the time of the last attack, and security recommendations.

   • Statistics: displays the total number of events, the number of blackhole events, and the number of traffic scrubbing events within the specified time range.

   You can apply the following filters to the event list.

   Filter	Description
   Event Type	Filters events by event type. Valid values: traffic scrubbing or blackhole. traffic scrubbing: triggered when the traffic rate reaches the threshold in bits per second (bps) or packets per second (pps). For more information, see Cancel traffic scrubbing. blackhole: triggered when the traffic exceeds the maximum DDoS mitigation threshold of the asset that is assigned a public IP address. For more information, see Alibaba Cloud blackhole filtering policy.
   Asset Type	Filters events by asset type. Valid values: ECS, SLB, EIP, NAT, IPv6 gateway, Simple Application Server, WAF, GA, and AnycastEIP.
   Event Status	Filters events by event status. Valid values: In Progress or Ended.
   IP Address	Enter the public IP address of an asset to search for events.

   The following table describes the columns in the event list.

   Column	Description
   Asset	The information about the asset that is under the DDoS attack, including the public IP address and the instance ID.
   Event	The attack type (such as volumetric) and the event type (traffic scrubbing or blackhole) of the attack event.
   Time	The start time, end time, and duration of the attack event.
   Attack Metrics	The trigger value and peak value (bps/pps) of the attack event.
   DDoS Plan	The information about the Anti-DDoS plan that the asset currently uses.

4. (Optional) In the Actions column, click View Details to open the Event Details panel and view the following information:

   • Basic Information: displays the attack target IP address, the event type (traffic scrubbing or blackhole) and status, the attack type, the Anti-DDoS plan and the assessment of mitigation capabilities, the trigger value (bps/pps), and the start and end times. For traffic scrubbing events, the peak attack value is also displayed.

   • Traffic: displays the traffic trend chart of the attack event.

     Note

     • If your asset has been released, the message You cannot view traffic details because the asset is removed from the current account. appears.

     • Traffic trend charts are not available for attack events that occurred more than 7 days ago (IPv4 assets) or more than 3 hours ago (IPv6 assets).

     • If the asset is an AnycastEIP, you cannot view the traffic trend in the event details.

   • Mitigate: displays the mitigation result of the attack event.

     • For blackhole events: displays the blackhole duration and the blackhole triggering threshold of Anti-DDoS Basic. You can click Upgrade Anti-DDoS Plan to improve your mitigation capabilities.

     • For traffic scrubbing events: displays the attack duration, the peak scrubbing bandwidth, and the mitigation result.

   • Attack Event Analysis: provides an AI-generated attack analysis (for reference only), including a summary of the attack type, an explanation of how the attack works, and protection recommendations. This helps you understand the attack characteristics and develop targeted protection strategies.

FAQ

Do multiple attack events belong to the same attack?

The DDoS platform treats each attack, from its start to its end, as an independent event. Events are recorded separately, no matter how short the interval between them is.

How do I determine whether multiple attack events belong to the same attack wave?

Download the pcap file of each event and compare the attacked ports and the attack types (such as SYN flood and NTP reflection attack). If the attack types are the same, the events most likely belong to the same attack wave.