Elastic IP Address:Billing FAQ

• When you change the billing method, you will receive a refund for the remaining subscription fees.

  We refund the amount you actually paid to your original payment source. For information about how refunds are calculated, see Refunds for changing the billing method from subscription to pay-as-you-go.

• After the change, you are charged for the pay-by-bandwidth EIP based on usage.

  The fee for a pay-by-bandwidth EIP = Bandwidth fee + EIP configuration fee (public IP retention fee).

Example: You have a subscription EIP with a maximum bandwidth of 300 Mbps in the China (Beijing) region that uses the BGP (Multi-ISP) line type. The EIP is not associated with any cloud resource. At 08:15:00 on November 20, 2024, you change the billing method of this EIP to EIP. After the change, you release the EIP at 22:30:00 on November 20, 2024. You will receive a bill for the pay-as-you-go EIP on November 21, 2024. The pay-as-you-go EIP fees for November 20, 2024 are calculated as follows:

The prices in this example are for reference only. For actual prices, see the console.

You cannot switch a pay-as-you-go EIP to a subscription.

• For a pay-as-you-go EIP:

  • You are charged an EIP configuration fee (public IP retention fee) immediately after you apply for an EIP. You are not charged this fee if the EIP is allocated from a specified IP address pool.

  • After you associate the EIP with a resource, the EIP configuration fee (public IP retention fee) is waived only if the EIP is directly associated with an ECS or ECI instance in a VPC and the EIP quota for your Alibaba Cloud account is 2,000 or less.

  To avoid unnecessary charges, we recommend that you apply for an EIP only when you need it.

• For a subscription EIP: You are not charged an EIP configuration fee (public IP retention fee).

A sudden spike in EIP data transfer can lead to an increase in fees. You can troubleshoot the issue based on the following information:

Possible causes

• Business-related issues: Increased traffic due to system updates or business growth.

• System vulnerabilities: Flaws in your applications that inadvertently generate a large number of network requests.

• Malicious intrusions or scanning: Increased traffic caused by malicious attacks, web crawlers, and other forms of unwanted access.

• Improper network configuration: Misconfigured rules for security groups or firewalls that allow a large number of unwanted requests.

Troubleshooting guide

1. Check monitoring data

   You can use Cloud Monitor to view the traffic and bandwidth usage of your EIP and analyze the patterns and trends of traffic exceptions. For more information, see Monitoring and alerting.

   You can also take the following measures to more quickly and accurately identify unusual traffic in the future:

   • Enable fine-grained monitoring: You can monitor changes in Internet service traffic in real time and adjust the maximum bandwidth of your EIP accordingly.

   • Enable Internet traffic analysis: You can view top traffic information consumed by communication between your EIP and external IP addresses.

   • Create an alert rule for bandwidth usage: When bandwidth usage abnormally increases, Cloud Monitor can send prompt alert notifications, allowing you to quickly investigate and address the issue.

2. Locate the abnormal process

   • Use Cloud Monitor: Use the process monitoring feature of Cloud Monitor to identify the abnormal process that occupies network resources based on the time period of the traffic spike. For more information, see Process monitoring.

   • Use network monitoring tools: Use the appropriate tools based on the operating system of the server associated with the EIP to view traffic usage and identify the abnormal process that occupies network resources.

     • Linux: You can use tools such as sar, iftop, and nethogs to check the network traffic load on an ECS instance. For more information, see Troubleshoot high network bandwidth usage on Linux instances.

     • Windows: You can use built-in Microsoft tools such as Task Manager, Resource Monitor, Performance Monitor, Process Explorer, and Xperf (available in Windows Server 2008 and later) to analyze traffic usage. For more information, see Troubleshoot high network bandwidth usage on Windows instances.

3. Analyze log files

   By viewing and analyzing server log files, you can identify the source of the traffic and the type of requests.

   Command examples: View server logs

   View logs in Linux

   • View NGINX access log: cat /var/log/nginx/access.log

   • View Apache access log (choose the path based on your distribution):

     • Debian/Ubuntu: cat /var/log/apache2/access.log

     • CentOS/RHEL: cat /var/log/httpd/access_log

   View logs on Windows

   The specific path of NGINX and Apache access log files depends on the installation and configuration. Use your actual installation path. The paths in the following commands are common default examples.

   • If the NGINX access log path is C:\Program Files\nginx\logs\access.log, run the following command to view the access log: type "C:\Program Files\nginx\logs\access.log"

   • If the Apache access log path is C:\Program Files\Apache Software Foundation\Apache2.4\logs, run the following command to view the access log: type "C:\Program Files\Apache Software Foundation\Apache2.4\logs\access.log"

   Identify IPs with high request frequency

   After viewing the log file, you can use the following command to count the IPs with the most requests in access.log and quickly spot suspicious sources.

   The example uses Linux and the default NGINX log path.

   awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

   Command description:

   • awk '{print $1}': Extract the first field from each log line. With the default combined log format, this is the client IP ($remote_addr).

   • sort: Sort the extracted IP addresses to prepare for aggregation.

   • uniq -c: Count the occurrences of each IP address.

   • sort -rn: Sort the counts in descending order.

   • head -20: Return the top 20 IP addresses with the most requests.

   To count entries in Apache logs, replace the path with the actual Apache log path, for example, /var/log/apache2/access.log.

   The command above assumes the log uses the default combined format for NGINX or Apache, in which the first field is the client IP address. If your server sits behind a reverse proxy, a CDN, Server Load Balancer (SLB), or Global Accelerator (GA), the first field is the upstream proxy IP address rather than the real client IP address, and the resulting statistics will point entirely to the proxy side. The real client IP address is typically carried in the X-Forwarded-For request header. In this case, first add $http_x_forwarded_for to the NGINX log_format directive to record this header, and then adjust the field that awk extracts (for example, take the first IP address in the XFF list).

4. Check security group and firewall configurations

   Check your security group rules or firewall configurations to close unnecessary ports and services and strictly control access permissions.

   For information about how to configure security groups, see Add a security group rule. If you need customized or more fine-grained access control, configure your system firewall based on the following information:

   • Linux firewall configuration example: Block suspicious IP addresses and ports

     # View firewall rules (iptables)
     sudo iptables -L -n -v
     # Add a firewall rule to block a suspicious IP address
     sudo iptables -A INPUT -s <suspicious-ip> -j DROP

   • On a Windows system, you can configure firewall rules by using the Windows Defender Firewall with Advanced Security interface.

5. Check your applications

   Use antivirus software or security tools to check for malware. Scan your servers for vulnerabilities and promptly update your systems and software.

   You can use Alibaba Cloud Security Center to detect and block various security threats, including virus propagation, hacker attacks, ransomware encryption, vulnerability exploits, AccessKey pair leaks, and malicious mining.