Blackhole filtering policy of Alibaba Cloud

Basic mitigation capability provided by Anti-DDoS Basic

Anti-DDoS Basic provides a basic mitigation capability from 500 Mbit/s to 5 Gbit/s against DDoS attacks for some Alibaba Cloud assets that are assigned public IP addresses. The capability is provided free of charge. In the following sections, Alibaba Cloud assets that are assigned public IP addresses are referred to as assets. The basic mitigation capability varies based on the region and specifications of an asset. For more information, see View the thresholds that trigger blackhole filtering in Anti-DDoS Basic and Configure traffic scrubbing thresholds.

A higher mitigation capability reduces the possibility of blackhole filtering. To prevent blackhole filtering from being triggered, you must increase the mitigation capability (blackhole filtering threshold) for your asset.

View asset status, traffic, and attack IPs

1. Log on to the Traffic Security console.

2. View asset status

   1. In the upper-left corner of the Assets page, select the region where your asset resides and click the corresponding tab.

   2. In the asset list, check whether Under blackhole is displayed in the IP Status column for your asset.

3. View asset traffic and attack IPs

   1. On the Event Center page, view the blackhole filtering or traffic scrubbing event for your asset. You can also click View Details to view the inbound traffic in bit/s and packet per second (pps).

   2. Click Download in the upper-right corner of the page, then use tools like Wireshark to open the downloaded packet and view the attack IPs.

Estimate the time when blackhole filtering is automatically deactivated

1. View the time when an asset was last attacked.

   Log on to the Traffic Security console. On the Event Center page, find the asset that you want to manage and view the time when the asset was last attacked.

   Note

   If an asset receives multiple DDoS attacks, the duration of blackhole filtering is calculated after the last DDoS attack stops.

2. View the duration of blackhole filtering.

   On the Assets page, view the duration of blackhole filtering for the asset.

3. Estimate the time when blackhole filtering is automatically deactivated.

   For example, the asset was attacked at 12:30, and the duration of blackhole filtering is 150 minutes. In this case, blackhole filtering is expected to be deactivated at 15:00.

   Note

   The estimated time is provided for reference only. If your asset receives continuous DDoS attacks, the duration of blackhole filtering may be longer.

How to deactivate blackhole filtering

During blackhole filtering, Alibaba Cloud continuously monitors the status of DDoS attacks. After the DDoS attacks stop for a period of time, Alibaba Cloud automatically deactivates blackhole filtering for your asset. Then, your asset can be accessed over the Internet. If you want to restore your service during blackhole filtering, you can manually deactivate blackhole filtering for your asset that is protected by an Anti-DDoS instance of a paid edition.

Anti-DDoS instance of a paid edition not purchased

You cannot manually deactivate blackhole filtering for your asset. If you want to restore your service or log on to your server to obtain files during blackhole filtering, refer to the instructions provided in Restore workloads of an ECS instance on which blackhole filtering is triggered.

Anti-DDoS instance of a paid edition purchased

You can wait for Alibaba Cloud to automatically deactivate blackhole filtering after the duration of blackhole filtering expires or manually deactivate blackhole filtering. If you manually deactivate blackhole filtering, you can deploy a mitigation plan within a specific period of time. However, DDoS attacks cannot be mitigated. After you manually deactivate blackhole filtering, blackhole filtering may be triggered again if the DDoS attacks do not stop.

How to select an Anti-DDoS service

• Anti-DDoS Origin: Anti-DDoS Origin is a security service that enhances mitigation against DDoS attacks for resources of Alibaba Cloud services. Anti-DDoS Origin directly protects the resources. You do not need to change the IP addresses of the resources that you want to protect or consider the limits on the number of Layer 4 ports or Layer 7 domain names. You need to only add the IP address of an asset to an Anti-DDoS Origin instance for protection.

• Anti-DDoS Proxy: Anti-DDoS Proxy is a proxy-based service that is provided by Alibaba Cloud to mitigate volumetric and resource exhaustion DDoS attacks. Anti-DDoS Proxy can protect servers that are deployed on Alibaba Cloud, on third-party clouds, and in data centers. If volumetric DDoS attacks are launched against your service that is added to Anti-DDoS Proxy, Anti-DDoS Proxy forwards traffic to the anti-DDoS scrubbing centers by using DNS resolution for scrubbing and forwards only service traffic to the origin server.

For more information about selection instructions and billing, see Scenario-specific anti-DDoS solutions, Billing description of Anti-DDoS Origin, and Billing description of Anti-DDoS Proxy.

FAQ

• Why am I unable to manually deactivate blackhole filtering for an Anti-DDoS Basic instance?

• Can I use ACLs to mitigate DDoS attacks and prevent blackhole filtering from being triggered?

• Why does the traffic data in the Anti-DDoS Origin console differ from that in CloudMonitor and other cloud services?