Queries attack events.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates the sample code of the operation for different SDKs.

Request parameters

Parameter Type Required Example Description
Action String Yes DescribeDDosAllEventList

The operation that you want to perform. Set the value to DescribeDDosAllEventList.

EndTime Long Yes 1604073600

The end of the time range to query. This value is a UNIX timestamp representing the number of seconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

PageNumber Integer Yes 1

The number of the page to return. Pages start from page 1.

PageSize Integer Yes 10

The number of entries to return on each page.
StartTime Long Yes 1598889600

The beginning of the time range to query. This value is a UNIX timestamp representing the number of seconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

EventType String No defense

The type of the attack event that you want to query. Valid values:

Note This parameter is empty by default, which indicates that all types of attack events are queried.
  • web-cc : events of the resource exhaustion attacks on websites
  • cc: events of the connection flood attacks
  • defense: attack events that trigger traffic scrubbing
  • blackhole: attack events that trigger blackhole filtering

If you want to query multiple types of attacks, separate them with commas (,).

All Alibaba Cloud API operations must include common request parameters. For more information about common request parameters, see Common parameters.

For more information about sample requests, see the "Examples" section of this topic.

Response parameters

Parameter Type Example Description
AttackEvents Array of AttackEvent

The information about the attack events.
EndTime Long 1600953999

The time when the attack event stopped. This value is a UNIX timestamp representing the number of seconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

EventType String defense

The type of the attack event. Valid values:

  • web-cc: attack events that trigger resource exhaustion attacks on websites
  • cc: attack events that trigger connection flood attacks
  • defense: attack events that trigger traffic scrubbing
  • blackhole: attack events that trigger blackhole filtering
Ip String 203.***. ***.52

The target of the attack event. Different targets are returned for different event types.

  • web-cc: The domain name of an attacked website was returned.
  • cc: The IP address of an attacked Anti-DDoS Pro or Anti-DDoS Premium instance was returned.
  • defense and blackhole: The IP address of an attacked Anti-DDoS Pro or Anti-DDoS Premium instance was returned.
Mbps Long 2415

The bandwidth of attack traffic. Unit: Mbit/s.
Port String 80

The attacked port.

Note This parameter is returned only for connection flood attacks.
Pps Long 204800

The packet forwarding rate of attack traffic. Unit: packets per second.
StartTime Long 1600951380

The time when the attack event started. This value is a UNIX timestamp representing the number of seconds that have elapsed since the epoch time January 1, 1970, 00:00:00 UTC.

RequestId String 0AA2B635-69BD-499D-9587-5782663DC0F6

The ID of the request.
Total Long 2

The total number of attack events.

Examples

Sample requests

http(s)://[Endpoint]/? Action=DescribeDDosAllEventList
&EndTime=1604073600
&PageNumber=1
&PageSize=10
&StartTime=1598889600
&<Common request parameters>

Sample success responses

XML format 

<DescribeDDosAllEventListResponse>
	  <RequestId>0AA2B635-69BD-499D-9587-5782663DC0F6</RequestId>
	  <Total>2</Total>
	  <AttackEvents>
		    <Pps>2870</Pps>
		    <EndTime>1600951860</EndTime>
		    <EventType>web-cc</EventType>
		    <Ip>***.example.com</Ip>
		    <StartTime>1600951470</StartTime>
		    <Mbps>0</Mbps>
	  </AttackEvents>
	  <AttackEvents>
		    <Pps>204800</Pps>
		    <EndTime>1600953999</EndTime>
		    <EventType>defense</EventType>
		    <Port></Port>
		    <Ip>203. ***. ***.52</Ip>
		    <StartTime>1600951380</StartTime>
		    <Mbps>2415</Mbps>
	  </AttackEvents>
</DescribeDDosAllEventListResponse>

JSON format 

{
	"RequestId": "0AA2B635-69BD-499D-9587-5782663DC0F6",
	"Total": 2,
	"AttackEvents": [
		{
			"Pps": 2870,
			"EndTime": 1600951860,
			"EventType": "web-cc",
			"Ip": "***.example.com",
			"StartTime": 1600951470,
			"Mbps": 0
		},
		{
			"Pps": 204800,
			"EndTime": 1600953999,
			"EventType": "defense",
			"Port": "",
			"Ip": "203. ***. ***.52",
			"StartTime": 1600951380,
			"Mbps": 2415
		}
	]
}

Error codes

For a list of error codes, visit the API Error Center.