All Products
Search

This Product

    Anti-DDoS:Restore workloads of an ECS instance on which blackhole filtering is triggered

    Document Center

    Anti-DDoS:Restore workloads of an ECS instance on which blackhole filtering is triggered

    Last Updated:Sep 02, 2026

    When blackhole filtering is triggered on an ECS instance, all inbound traffic is discarded and outbound traffic is blocked. The public IP address becomes unreachable from the Internet, and the instance can no longer call external services such as third-party APIs. This is expected behavior, not a server fault. Blackhole filtering is deactivated automatically when it expires, and the public IP address is then restored without a restart. This topic describes how to estimate the deactivation time, and how to restore urgent workloads by changing the public IP address or migrating to another ECS instance.

    Important

    Attackers can still find the new public IP address by pinging your domain name and attack again. Changing the IP address or migrating workloads is only a workaround. To resolve the issue, purchase Anti-DDoS Native or Anti-DDoS Proxy.

    Estimate the time when blackhole filtering is automatically deactivated

    Without Anti-DDoS Native or Anti-DDoS Proxy, you must wait for blackhole filtering to expire. If you have either service and your workloads are protected by it, you can deactivate blackhole filtering manually. For more information, see Deactivate blackhole filtering (Anti-DDoS Native) and Deactivate blackhole filtering (Anti-DDoS Proxy).

    1. View the most recent time when the ECS instance was attacked.

      Log on to the Traffic Security console. On the Event Center page, find the public IP address of the ECS instance and click Details to view the most recent attack time.

      Note

      If an asset receives multiple DDoS attacks, the duration of blackhole filtering is calculated after the last DDoS attack stops.

    2. View the duration of blackhole filtering.

      On the Assets page, view the total duration of blackhole filtering. The default is 2.5 hours. The actual duration ranges from 30 minutes to 24 hours based on attack frequency, and can be longer in rare cases.

    3. Estimate the time when blackhole filtering is automatically deactivated.

      For example, if the last attack was at 12:30 and the duration is 150 minutes, blackhole filtering is expected to be deactivated at 15:00.

      Note

      The estimate is for reference only. Continuous DDoS attacks extend the duration.

    You can wait for blackhole filtering to be deactivated automatically. In urgent cases, use one of the following solutions.

    Important

    After you change the public IP address or migrate your workloads, update your DNS records, database connections, and other affected settings.

    Solution 1: Change the public IP address of the ECS instance

    Important

    Repeatedly changing the public IP address of an instance that is under attack keeps the attack traffic on the cloud platform. Your Alibaba Cloud account may then be restricted, for example by being blocked from purchasing new instances.

    Change the elastic IP address (EIP) of the ECS instance

    1. (Optional) Apply for a new EIP.

    2. Disassociate the current EIP from the ECS instance.

      Important

    3. Associate the new EIP with the ECS instance.

    Change the system-assigned public IP address of the ECS instance

    Within 6 hours after the instance is created

    You can change the public IP address in the ECS console. The instance must be in the Stopped state, and you can change the address up to three times.

    Note

    Stop a pay-as-you-go VPC instance in standard mode. In economical mode, you may be unable to change the public IP address. For more information, see Economical mode. For a fourth change within the 6-hour window, follow the procedure for instances created more than 6 hours ago.

    1. Find the instance, and in the Actions column choose icon1 > Network and Security Group > Change Public IP Address.

    2. Confirm the details in the Change Public IP Address message and click OK. The new address is shown in the message.

    More than 6 hours after the instance is created

    You cannot change the existing address. Reassign one as follows:

    1. Convert the system-assigned public IP address of the VPC instance into an EIP. The address itself does not change.

      Important

      • This operation is not supported within 24 hours before a subscription instance expires.

      • If a subscription instance is billed by pay-by-bandwidth, first change the network billing method to Pay-by-traffic. For more information, see Change from pay-by-bandwidth to pay-by-traffic.

    2. Disassociate the converted EIP from the instance. The EIP fees described in the preceding section also apply here.

    3. Change the public bandwidth of the instance to more than 1 Mbit/s. The system then assigns a new public IP address. For more information, see Modify the bandwidth configurations of subscription instances or Modify the bandwidth configurations of pay-as-you-go instances. The new address appears in the IP Address column of the instance list.

    Solution 2: Use a custom image to create an ECS instance with the same configurations

    1. Create a custom image of the ECS instance on which blackhole filtering is triggered.

      Note

      We recommend that you create snapshots regularly during O&M so that you can build a custom image from a snapshot when you need to restore workloads quickly. For more information, see Create policy and Create a custom image from a snapshot.

    2. Use the custom image to create an ECS instance with the same configurations.

    Solution 3: Replace the server by using SMC

    Server Migration Center (SMC) is an Alibaba Cloud migration platform. Use it to migrate the ECS instance on which blackhole filtering is triggered into a custom image, and then create a new ECS instance from that image.

    1. Import the ECS instance into SMC as a migration source.

    2. Create a migration task to migrate system configurations and business data into a custom image.

    3. Use the custom image to create an ECS instance with the same configurations.

    Solution 4: Log on to the ECS instance and migrate business data

    An ECS instance on which blackhole filtering is triggered cannot be reached over the Internet, but you can still connect to it by using Workbench, Session Manager, Virtual Network Computing (VNC), or another ECS instance in the same VPC.

    For more information, see Connect to your instance. This example uses another ECS instance in the same VPC.

    Usage notes

    Both instances must reside in the same region, VPC, and security group, and must be able to reach each other.

    Procedure

    1. Log on to a healthy ECS instance by using its private or public IP address.

    2. From that instance, use a command or a tool to connect to the private or public IP address of the instance on which blackhole filtering is triggered.

      The following table lists the common connection methods.

      Operating system of the ECS instance on which blackhole filtering is triggered

      Operating system of the ECS instance on which blackhole filtering is not triggered

      Connection method

      References

      Windows

      Windows

      Use Microsoft Terminal Services Client (MSTSC).

      Use RDP client or Windows App

      Linux

      Use rdesktop.

      Linux

      Windows

      Use PuTTY.

      Linux

      Run an SSH command.

      ssh root@<System-assigned public IP address or EIP of the instance>

    3. Migrate your business data to the healthy ECS instance.

    FAQ

    What do I do if blackhole filtering is triggered on my IP address and I cannot change the public IP address?

    Blackhole filtering that is triggered by volumetric DDoS attacks cannot be deactivated manually. You must wait for the system to detect that the attack has stopped.

    If account restrictions or resource constraints prevent you from changing the public IP address, you must wait. To estimate the deactivation time, see the "Estimate the time when blackhole filtering is automatically deactivated" section of this topic.

    To avoid triggering blackhole filtering again, purchase Anti-DDoS Native (Enterprise) or Anti-DDoS Proxy based on your business requirements.

    References