All Products
Search

This Product

    Elastic Compute Service:Source/Destination Check

    Document Center

    Elastic Compute Service:Source/Destination Check

    Last Updated:Jun 21, 2026

    Attackers can use IP spoofing to send packets with a forged source IP address, making traffic appear to come from a trusted network. Enabling Source/Destination Check for an elastic network interface (ENI) prevents these attacks and enhances your network security.

    What is Source/Destination Check

    When Source/Destination Check is enabled for an ENI, the ENI only accepts packets destined for its own IP address and only sends packets originating from its own IP address. When disabled, the ENI does not verify the source or destination IP addresses of packets.

    Note

    To improve security and stability, this feature will be enabled by default for new instances and ENIs in a phased release starting April 22, 2025. For more information, see the announcement.

    Benefits of enabling Source/Destination Check

    • Prevents IP spoofing: This feature verifies that the source IP address of a packet matches the IP address of the device that sent it, which prevents IP spoofing attacks.

    • Enhances security: Enabling Source/Destination Check reduces the risk of unauthorized data transmission. This is useful if you want to prevent your instance from routing packets for other services. With this check enabled, only traffic generated by or for the instance itself is processed, which helps prevent potential security vulnerabilities.

    • Maintains network stability and efficiency: This feature prevents data flow disruptions from incorrect routing, which contributes to network stability and improves resource utilization.

    Note that Source/Destination Check alone is not sufficient to protect against all types of network threats. For comprehensive protection, combine this feature with other technologies and strategies based on your business needs, such as security group configurations, network ACLs, SSL/TLS encryption, authentication mechanisms, DDoS protection, and backing up important data, to protect your network from various forms of attack.

    Supported regions

    The Source/Destination Check feature is available only in the following regions. In other regions, this feature is disabled by default.

    Click to view the list of supported regions

    Area

    Region name

    Region ID

    Asia Pacific - China

    China (Qingdao)

    cn-qingdao

    China (Beijing)

    cn-beijing

    China (Zhangjiakou)

    cn-zhangjiakou

    China (Hohhot)

    cn-huhehaote

    China (Ulanqab)

    cn-wulanchabu

    China (Hangzhou)

    cn-hangzhou

    China (Shanghai)

    cn-shanghai

    China (Nanjing - Local Region)

    cn-nanjing

    China (Fuzhou - Local Region)

    cn-fuzhou

    China (Shenzhen)

    cn-shenzhen

    China (Heyuan)

    cn-heyuan

    China (Guangzhou)

    cn-guangzhou

    China (Chengdu)

    cn-chengdu

    China (Hong Kong)

    cn-hongkong

    China (Wuhan - Local Region)

    cn-wuhan-lr

    Asia Pacific - Other

    Singapore

    ap-southeast-1

    Malaysia (Kuala Lumpur)

    ap-southeast-3

    Indonesia (Jakarta)

    ap-southeast-5

    Philippines (Manila)

    ap-southeast-6

    Thailand (Bangkok)

    ap-southeast-7

    Japan (Tokyo)

    ap-northeast-1

    South Korea (Seoul)

    ap-northeast-2

    Europe and Americas

    US (Virginia)

    us-east-1

    US (Silicon Valley)

    us-west-1

    Mexico

    na-south-1

    Germany (Frankfurt)

    eu-central-1

    UK (London)

    eu-west-1

    Middle East

    UAE (Dubai)

    me-east-1

    When to disable the source/destination check

    Disable Source/Destination Check in the following scenarios:

    • Multi-ENI scenarios: On an instance with multiple ENIs, packets might enter through one network interface (for example, eth1) and exit through another (for example, eth0). If Source/Destination Check is enabled on the primary ENI, it may affect traffic on a secondary elastic network interface.

      To resolve this issue, you can configure policy-based routing after you attach an ENI to an instance. For more information, see Configure policy-based routing for an ENI.

    • Network address translation: An instance acting as a network address translation (NAT) device needs to receive packets from other instances in the network and forward them to the internet or other networks. In this case, you must disable Source/Destination Check to allow traffic to pass through.

    • Routers: When an instance is configured as a network router, it must handle all traffic, not just traffic addressed to it. In this case, disabling Source/Destination Check is necessary for the instance to correctly forward packets.

    • Custom load balancers: When an instance acts as a custom load balancer, it may need to receive client requests and distribute them to different backend servers. In this situation, Source/Destination Check must also be disabled to allow this traffic pattern.

    • VPN endpoints: When an instance is used as a VPN server, it may need to process packets from different networks, which also requires disabling Source/Destination Check to allow these packets to pass through.

    • Advanced network architectures: For more complex network designs, such as implementing specific traffic control rules, integrating special firewall solutions, or performing detailed network monitoring, you may also need to disable Source/Destination Check to meet specific requirements.

    Configure the source/destination check

    Configure during ENI creation

    Unless your scenario is one of the scenarios that may require disabling Source/Destination Check, we recommend enabling this feature to improve network security.

    With an instance

    When you purchase an ECS instance, you can enable or disable Source/Destination Check for the primary ENI and any secondary elastic network interfaces created with the instance. For more information, see Create an instance by using the wizard. On the instance purchase page, find the Source/Destination Check option in the Networking and Security Group section. By default, this feature is disabled.

    Note

    • Some ECS instance types do not support attaching a secondary elastic network interface during instance creation. You can attach the ENI after the instance is created. For more information, see ECS instance types that must be stopped before you attach an ENI.

    • When you purchase an instance, you can attach a maximum of two ENIs: one primary ENI (automatically matched) and one secondary elastic network interface.

    Standalone

    You can configure Source/Destination Check when you create a standalone ENI and then attach the ENI to an instance. For more information, see Create and use an ENI.

    Note

    You can also call the CreateNetworkInterface API operation. When you create an elastic network interface, set the SourceDestCheck parameter to true to enable the feature or to false to disable it.

    Modify the check setting

    After an ENI is created, you can enable or disable its Source/Destination Check feature.

    Console

    1. Go to ECS Console - Elastic Network Interfaces.

    2. In the top navigation bar, select the region and resource group of the target ENI.

    3. Click the ID of the target ENI to go to its details page.

    4. You can view and change the status of the Source/Destination Check feature.

      In the Basic Information section of the ENI details page, find the Source/Destination Check field and click the Enable or Disable link next to it to change the status.

    API

    • Call the ModifyNetworkInterfaceAttribute API operation. For the ENI specified by NetworkInterfaceId, set the SourceDestCheck parameter to true to enable Source/Destination Check or to false to disable it.

    • After a successful modification, call the DescribeNetworkInterfaceAttribute operation to query the attributes of the ENI specified by NetworkInterfaceId. The SourceDestCheck parameter in the response is true if the feature is enabled and false if it is disabled.