When an Alibaba Cloud service is subject to a volumetric DDoS attack and the peak bandwidth (bps) of the attack traffic exceeds its DDoS mitigation capability, the Alibaba Cloud blackhole filtering policy temporarily blocks traffic between the cloud service and the Internet. This prevents further damage to the cloud service and prevents an attack on one cloud service from affecting the normal operation of other assets. Normal network communication is affected. This topic describes how to prevent and handle blackhole filtering.
Basic DDoS mitigation capability
After you purchase certain Alibaba Cloud assets that are assigned public IP addresses, they have free Anti-DDoS Basic mitigation capacity of 500 Mbps to 5 Gbps by default. The Anti-DDoS Basic mitigation capacity varies based on the region and specifications of the asset. For more information, see View the thresholds that trigger blackhole filtering in Anti-DDoS Basic and Configure traffic scrubbing thresholds.
If your normal service traffic (bps) exceeds the blackhole triggering threshold, promptly upgrade the specifications of your asset. Otherwise, your traffic may be identified as unusual traffic, causing the asset to enter blackhole filtering.
The greater an asset's DDoS mitigation capability, the less likely a DDoS attack is to trigger blackhole filtering. Therefore, increasing an asset's DDoS mitigation capability, which is the blackhole triggering threshold, is the only way to fundamentally prevent blackhole filtering.
View asset status, traffic, and attack IP addresses
Log on to the Traffic Security console.
View the status of your asset.
In the upper-left corner of the Assets page, select the region where the asset that is assigned a public IP address is located, and then click the corresponding asset tab.
In the asset list, check whether IP Status is Black Hole Activated.
View the traffic and attack IP addresses of the asset.
On the Event Center page, view blackhole filtering events or traffic scrubbing events. You can also click View Details to view inbound traffic in bps and pps.
In the upper-right corner of the page, click Download. Use a tool such as Wireshark to open the downloaded data packet and view the attack IP addresses.
If you cannot find the target IP address in the notification in Asset Center, the IP address may be bound to an Anti-DDoS Proxy instance instead of being an asset that is assigned a public IP address and directly managed by Anti-DDoS Native. Switch to the Anti-DDoS Proxy console to continue troubleshooting.
In the left-side navigation pane, choose Anti-DDoS Proxy (Chinese Mainland) or Anti-DDoS Proxy (Outside Chinese Mainland). The selected region must match the region specified in the notification. If you select the wrong region, you cannot find the instance.
Go to Asset Management > Instances.
In the instance list, check the Exclusive IP Address column to confirm whether the target IP address in the notification is the exclusive IP address of an Anti-DDoS Proxy instance.
After you confirm that the target IP address belongs to an Anti-DDoS Proxy instance, use Protection Settings to view mitigation settings and status, and use View Report to view attack details.
Estimated blackhole duration
The default blackhole duration is 2.5 hours. The actual blackhole duration varies based on how frequently the asset is attacked and ranges from 30 minutes to 24 hours. In rare cases, it may be longer. The blackhole duration is mainly affected by the following factors:
Whether the attack continues. If the attack continues, the blackhole duration is extended and recalculated from the time of the extension.
Whether attacks are frequent. If a user is attacked for the first time, the blackhole duration is automatically shortened. Conversely, users who are attacked frequently are more likely to be attacked continuously, so the blackhole duration is extended.
For certain users whose assets enter blackhole filtering too frequently, Alibaba Cloud reserves the right to extend the blackhole duration and lower the blackhole triggering threshold. The actual blackhole duration is subject to the security event notification.
How to deactivate blackhole filtering
During blackhole filtering, Alibaba Cloud continuously monitors the status of the DDoS attack. Some time after the attack ends, Alibaba Cloud automatically deactivates blackhole filtering for the asset and restores its Internet access. If you urgently need to restore your service while the asset is in blackhole filtering, you can purchase a commercial Anti-DDoS product and then manually deactivate blackhole filtering.
Blackhole filtering blocks public network access to the asset at Alibaba Cloud's upstream router layer and is unrelated to the running status of the asset. Therefore, operations performed on the server side during blackhole filtering, such as restarting the instance, rolling back a disk snapshot, reinstalling the operating system, or modifying security groups or system configurations, do not affect the blackhole filtering status. These operations also cannot restore remote connections such as Secure Shell (SSH) and Remote Desktop Protocol (RDP), or management panels that rely on public network access.
Whether public network access can be restored depends only on whether blackhole filtering is deactivated. If you have not purchased a commercial Anti-DDoS product, you can only wait for the blackhole duration to expire, which is 2.5 hours by default and ranges from 30 minutes to 24 hours in practice. For details, see the "Estimated blackhole duration" section in this topic. After blackhole filtering is deactivated, try the connection again. Repeatedly restarting the instance or frequently modifying configurations does not help restore your service and may introduce additional data or configuration risks. To restore your service immediately, see the following sections about purchasing and using a commercial Anti-DDoS product.
Without a commercial Anti-DDoS product
Manual deactivation is not supported. You can only wait for the blackhole duration to expire, after which blackhole filtering is automatically deactivated. If you urgently need to restore your service or log on to the server to obtain files, see Restore workloads after blackhole filtering is triggered on an Elastic Compute Service (ECS) instance.
If you frequently change or release attacked cloud assets, such as ECS addresses, elastic IP addresses (EIPs), SLB addresses, and simple application servers, and the effect spreads to cloud tenants as a whole, platform restrictions may be imposed.
After you change an asset's public IP address or replace the service server, attackers can still obtain the new IP address by using methods such as pinging your domain name and then launch another attack. To resolve the root cause, purchase Anti-DDoS Native or Anti-DDoS Proxy.
With a commercial Anti-DDoS product
You can wait for the blackhole duration to expire and have blackhole filtering automatically deactivated, or you can manually deactivate blackhole filtering. Manually deactivating blackhole filtering does not mean that DDoS attacks can be mitigated. It only buys time to deploy a mitigation plan. After you manually deactivate blackhole filtering, if the DDoS attack has not ended, the asset may be attacked again and enter blackhole filtering.
Commercial Anti-DDoS service | Manual deactivation method | Description |
Anti-DDoS Native |
| The number of manual deactivations available per month is limited and is generally no fewer than the number of protected IP addresses in your specifications. |
Anti-DDoS Proxy (Chinese Mainland) |
|
|
Anti-DDoS Proxy (Outside Chinese Mainland) | Manual deactivation is not required. | Unlike Anti-DDoS Proxy (Chinese Mainland) instances, which have fixed mitigation bandwidth, Anti-DDoS Proxy (Outside Chinese Mainland) instances provide advanced mitigation with no upper limit. Under normal circumstances, manual deactivation is not required. |
Select an Anti-DDoS product
Anti-DDoS Native: Anti-DDoS Native is a security product that directly increases the DDoS mitigation capability of Alibaba Cloud services. It is simple to deploy and does not require changes to your network architecture. It has no limits on Layer 4 ports or the number of Layer 7 domain names. Associate the IP address of a cloud service with an Anti-DDoS Native instance to enable mitigation.
Anti-DDoS Proxy: Anti-DDoS Proxy (Anti-DDoS) is a proxy-based DDoS attack mitigation service provided by Alibaba Cloud. It defends against volumetric DDoS attacks and resource exhaustion DDoS attacks and supports the protection of Alibaba Cloud servers, non-Alibaba Cloud servers, and servers outside the cloud. After your service is added to Anti-DDoS Proxy, when a volumetric DDoS attack occurs, Anti-DDoS Proxy uses DNS resolution to reroute traffic to a DDoS scrubbing center and forwards clean traffic to the server.
For detailed selection guidance and billing information, see How to select an Anti-DDoS product, Anti-DDoS Native billing, and Anti-DDoS Proxy billing.