Anti-DDoS Native logs contain two categories of fields. Event fields record state changes such as the start or end of a scrubbing session or the activation of blackhole filtering. Traffic scrubbing fields record packet-level statistics for what each mitigation policy allowed or denied during a scrubbing session.
Event fields
Event logs are generated when a protected asset experiences a state change: a scrubbing session begins or ends, or blackhole filtering is activated or lifted.
| Field | Description | Example value |
|---|---|---|
data_type |
The data type. Valid values:Global_SC_Detection (traffic forwarded by the Anti-DDoS Proxy scrubbing center, protected by a diversion instance), Global_SC_Mitigation (traffic scrubbed by the Anti-DDoS Proxy scrubbing center, protected by a diversion instance), Regional_SC_Detection (inbound traffic in the region where Alibaba Cloud assets reside), Regional_SC_Mitigation (scrubbed traffic in the region where Alibaba Cloud assets reside), event (attack event data). |
Regional_SC_Mitigation |
event_time |
Time of the event, as a UNIX timestamp. Unit: seconds. | 1624434027 |
event_type |
The event type. Valid values:mitigation_begin (a traffic scrubbing event begins), mitigation_ended (a traffic scrubbing event ends), blackhole_begin (a blackhole filtering event begins), blackhole_ended (a blackhole filtering event ends). |
mitigation_begin |
instance_id |
ID of the Anti-DDoS Native instance. | ddosbgp-cn-n6w203qg**** |
ip |
IP address of the protected asset. | 39.XX.XX.23 |
kbps_in |
Inbound traffic bandwidth. Unit: Kbit/s. | 1000 |
new_con |
Number of new connections. | 1000 |
pps_in |
Inbound packet forwarding rate. Unit: packets per second. | 1000 |
qps |
Queries per second (QPS). | 1000 |
scrubbing_center |
The region of the scrubbing center. Valid values:us_west (US (Virginia)), us_east (US (Silicon Valley)), frankfurt (Germany (Frankfurt)), hk (China (Hong Kong)), singapore (Singapore), malaysia (Malaysia (Kuala Lumpur)), uk (UK (London)), japan (Japan (Tokyo)), total_summary (all regions), assets_base_region (the region where the asset resides). |
us_west |
subnet |
CIDR block used for traffic rerouting. | 1.XX.XX.1/24 |
uid |
ID of the Alibaba Cloud account. | 170457416359**** |
Traffic scrubbing fields
Traffic scrubbing logs record packet statistics for each scrubbing session. Each entry captures traffic at a point in time for a specific destination IP address and port. Fields are organized into three groups: overall traffic totals, per-protocol breakdowns, and per-policy allow and deny counts.
Overall traffic
| Field | Description | Example value |
|---|---|---|
time |
Time at which the log entry was generated, as a UNIX timestamp. Unit: seconds. | 1624434027 |
destination_ip |
Destination IP address. | 123.XX.XX.169 |
port |
Destination port. all (default) covers all ports. A specific value such as 80 covers that port only. |
80 |
total_traffic_in_bps |
Total bytes per second of all inbound packet types reaching the scrubbing center. Unit: bytes per second. | 8000 |
total_traffic_drop_bps |
Total bytes per second of all packet types that were discarded. Unit: bytes per second. | 800 |
total_traffic_in_pps |
Forwarding rate of all inbound packet types. Unit: packets per second. | 1000 |
total_traffic_drop_pps |
Forwarding rate of all discarded packet types. Unit: packets per second. | 1000 |
Per-protocol traffic
These fields break down inbound and discarded traffic by protocol or TCP flag type.
| Field | Description | Example value |
|---|---|---|
pps_types_in_tcp_pps |
Forwarding rate of inbound TCP packets. Unit: packets per second. | 100 |
pps_types_in_udp_pps |
Forwarding rate of inbound UDP packets. Unit: packets per second. | 1000 |
pps_types_in_icmp_pps |
Forwarding rate of inbound ICMP packets. Unit: packets per second. | 1000 |
pps_types_in_syn_pps |
Forwarding rate of inbound SYN packets. Unit: packets per second. | 1000 |
pps_types_in_ack_pps |
Forwarding rate of inbound ACK packets. Unit: packets per second. | 1000 |
pps_types_in_synack_pps |
Forwarding rate of inbound SYN-ACK packets. Unit: packets per second. | 1000 |
pps_types_in_finrst_pps |
Forwarding rate of inbound FIN or RST packets. Unit: packets per second. | 1000 |
pps_types_in_dns_pps |
Forwarding rate of inbound DNS packets. Unit: packets per second. | 1000 |
pps_types_drop_tcp_pps |
Forwarding rate of discarded TCP packets. Unit: packets per second. | 1000 |
pps_types_drop_udp_pps |
Forwarding rate of discarded UDP packets. Unit: packets per second. | 1000 |
pps_types_drop_icmp_pps |
Forwarding rate of discarded ICMP packets. Unit: packets per second. | 1100 |
pps_types_drop_syn_pps |
Forwarding rate of discarded SYN packets. Unit: packets per second. | 1000 |
pps_types_drop_ack_pps |
Forwarding rate of discarded ACK packets. Unit: packets per second. | 1000 |
pps_types_drop_synack_pps |
Forwarding rate of discarded SYN-ACK packets. Unit: packets per second. | 1000 |
pps_types_finrst |
Forwarding rate of discarded FIN or RST packets. Unit: packets per second. | 1000 |
pps_types_dns |
Forwarding rate of discarded DNS packets. Unit: packets per second. | 1000 |
Per-policy traffic
Each field records the forwarding rate of traffic that a specific mitigation policy allowed or denied.
Packet checking
| Field | Description | Example value |
|---|---|---|
policy_packet_checking_acct_pps |
Packets allowed by the default packet checking policy. Unit: packets per second. | 1000 |
policy_packet_checking_drop_pps |
Packets denied by the default packet checking policy. Unit: packets per second. | 1000 |
Source IP address-based authentication
| Field | Description | Example value |
|---|---|---|
policy_source_ip_authentication_checked_pps |
Packets currently being checked by the default source IP address-based authentication policy. Unit: packets per second. | 1000 |
policy_source_ip_authentication_succeed_pps |
Packets that passed the default source IP address-based authentication policy check. Unit: packets per second. | 1000 |
policy_source_ip_authentication_acct_pps |
Packets allowed by the default source IP address-based authentication policy. Unit: packets per second. | 1000 |
policy_source_ip_authentication_drop_pps |
Packets denied by the default source IP address-based authentication policy. Unit: packets per second. | 1000 |
Source IP address-based rate limiting
| Field | Description | Example value |
|---|---|---|
policy_source_ip_rate_limitation_drop_syn_pps |
SYN packets denied by the default source IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_source_ip_rate_limitation_drop_con_max_pps |
Packets denied because the number of concurrent connections from the source IP address exceeded the limit set by the default source IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_source_ip_rate_limitation_drop_con_rate_pps |
Packets denied because the connection rate from the source IP address exceeded the limit set by the default source IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_source_ip_rate_limitation_drop_udp_rate_pps |
UDP packets denied by the default source IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_source_ip_rate_limitation_drop_tcpack_rate_pps |
ACK packets denied by the default source IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_source_ip_rate_limitation_drop_tcpsynack_rate_pps |
SYN-ACK packets denied by the default source IP address-based rate limiting policy. Unit: packets per second. | 1000 |
Destination IP address-based rate limiting
| Field | Description | Example value |
|---|---|---|
policy_destination_ip_rate_limitation_drop_syn_rate |
SYN packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_destination_ip_rate_limitation_drop_udp_rate |
UDP packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_destination_ip_rate_limitation_drop_ack_rate |
ACK packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_destination_ip_rate_limitation_drop_icmp_rate |
ICMP packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_destination_ip_rate_limitation_drop_synack_rate |
SYN-ACK packets denied by the default destination IP address-based rate limiting policy. Unit: packets per second. | 1000 |
policy_destination_ip_rate_limitation_drop_other_rate |
Packets denied by the default destination IP address-based rate limiting policy, excluding UDP, ICMP, SYN, SYN-ACK, and ACK packets. Unit: packets per second. | 1000 |
Fingerprint filtering
Fingerprint filtering policies can be customized in Mitigation Settings.
| Field | Description | Example value |
|---|---|---|
policy_layer_4_filter_l4_filiter_drop_pps |
Packets denied by all fingerprint filtering policies combined. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filiter_acct_num |
Packets allowed by all fingerprint filtering policies combined. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_1_pps |
Packets denied by the first fingerprint filtering policy. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_2_pps |
Packets denied by the second fingerprint filtering policy. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_3_pps |
Packets denied by the third fingerprint filtering policy. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_4_pps |
Packets denied by the fourth fingerprint filtering policy. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_5_pps |
Packets denied by the fifth fingerprint filtering policy. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_6_pps |
Packets denied by the sixth fingerprint filtering policy. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_7_pps |
Packets denied by the seventh fingerprint filtering policy. Unit: packets per second. | 1000 |
policy_layer_4_filter_l4_filite_drop_rule_8_pps |
Packets denied by the eighth fingerprint filtering policy. Unit: packets per second. | 1000 |
First-packet-dropping (TCP)
| Field | Description | Example value |
|---|---|---|
policy_retransmission_authentication_acct_pps |
Packets allowed by the default first-packet-dropping policy. Unit: packets per second. | 1000 |
policy_retransmission_authentication_drop_pps |
Packets denied by the default first-packet-dropping policy. Unit: packets per second. | 1000 |
First-packet-dropping (DNS)
| Field | Description | Example value |
|---|---|---|
policy_dns_retransmission_authentication_acct_pps |
Packets allowed by the default first-packet-dropping policy for domain names. Unit: packets per second. | 100 |
policy_dns_retransmission_authentication_drop_pps |
Packets denied by the default first-packet-dropping policy for domain names. Unit: packets per second. | 1000 |
Domain-based authentication
| Field | Description | Example value |
|---|---|---|
policy_dns_domain_authentication_succ_domain_pps |
Packets that passed the default domain-based authentication policy check. Unit: packets per second. | 1000 |
policy_dns_domain_authentication_fail_domain_pps |
Packets that failed the default domain-based authentication policy check. Unit: packets per second. | 1000 |
policy_dns_domain_authentication_acct_pps |
Packets allowed by the default domain-based authentication policy. Unit: packets per second. | 1000 |
policy_dns_domain_authentication_drop_pps |
Packets denied by the default domain-based authentication policy. Unit: packets per second. | 1000 |
SYN cookie
| Field | Description | Example value |
|---|---|---|
policy_syn_cookie_succ_check_pps |
Packets that passed the default SYN cookie-based policy check. Unit: packets per second. | 1000 |
policy_syn_cookie_fail_check_pps |
Packets that failed the default SYN cookie-based policy check. Unit: packets per second. | 1000 |
policy_syn_cookie_rebound_check_pps |
Packets redirected for verification by the default SYN cookie-based policy. Unit: packets per second. | 1000 |
policy_syn_cookie_acct_pps |
Packets allowed by the default SYN cookie-based policy. Unit: packets per second. | 1000 |
policy_syn_cookie_drop_pps |
Packets denied by the default SYN cookie-based policy. Unit: packets per second. | 1000 |
UDP protection
| Field | Description | Example value |
|---|---|---|
policy_udp_defense_in_pps |
Inbound UDP packets matched by the default UDP protection policy per second. Unit: packets per second. | 1000 |
policy_udp_defense_drop_pps |
Packets denied by the default UDP protection policy. Unit: packets per second. | 1000 |
DNS protection
| Field | Description | Example value |
|---|---|---|
policy_dns_ipdomain_rate_limitation_drop_over_rate_limitation_pps |
Packets discarded because IP address or domain name rate limits were triggered under the default DNS protection policy. Unit: packets per second. | 1000 |
TCP protection
| Field | Description | Example value |
|---|---|---|
policy_antitcp_in_pps |
Total rate of TCP packets that matched the TCP protection policy. Unit: packets per second. | 1000 |
policy_antitcp_drop_tcp_pps |
All TCP packets denied by the default TCP protection policy. Unit: packets per second. | 1000 |
policy_antitcp_drop_ack_pps |
ACK packets denied by the default TCP protection policy. Unit: packets per second. | 1000 |
policy_antitcp_drop_pushack_pps |
PUSHACK packets denied by the default TCP protection policy. Unit: packets per second. | 1000 |
policy_antiothertcp_session_cre_num_syn_pps |
Rate of sessions created by the TCP protection policy using SYN packets. Unit: packets per second. | 1000 |
policy_antiothertcp_session_cre_num_ack_pps |
Rate of sessions created by the TCP protection policy using ACK packets. Unit: packets per second. | 1000 |
policy_antiothertcp_succ_auth_num_syn_pps |
Rate of packets authenticated after a session was created by the TCP protection policy using SYN. Unit: packets per second. | 1000 |
policy_antiothertcp_succ_auth_num_ack_pps |
Rate of packets authenticated after a session was created by the TCP protection policy using ACK. Unit: packets per second. | 1000 |
policy_antiothertcp_acct_pps |
Packets allowed by other default TCP protection policies. Unit: packets per second. | 1000 |
policy_antiothertcp_drop_pps |
Packets denied by other default TCP protection policies. Unit: packets per second. | 1000 |