Viewing Outbound Traffic

Scenario

Outbound traffic analysis visualizes outbound traffic flowing from EIPs protected by the current firewall instance to the Internet. This capability helps you track outbound traffic trends, access destinations, targeted destination ports, and application distribution. With these insights, O&M teams can rapidly isolate anomalous traffic spikes and trace suspicious outbound connections. Additionally, the platform supports one-click blocking of high-risk destination IP addresses and data export for archiving, serving multiple operational needs including bandwidth capacity planning, routine security audits, and statutory compliance audits.

This section describes how to monitor and view outbound traffic information.

For instructions on viewing the global traffic topology visualization, which details VPC border, and Internet border information for all cloud assets, see Cloud Firewall Dashboard.

Constraints

• The data is collected from sessions. The statistics of a session is reported only after it is terminated.
• Traffic data is reported collectively after a session terminates. Consequently, persistent connections may experience a minor data display latency rather than real-time refreshes.
• Supported time ranges span from 5 minutes to 7 days. The system automatically adjusts the data aggregation granularity based on your selection. Custom intervals must be at least 5 minutes.
• To view data of private network assets initiating Internet connections, enable the VPC border firewall in the CFW professional edition. For details, see VPC border firewall.
• If intelligence-related tags (all intelligence tags or non-empty intelligence tags) are used for filtering on the External IP Addresses and External Domain Names tab pages, up to 1,000 records can be displayed.

Viewing Outbound Traffic

1. Enable EIP protection, and ensure that existing traffic passes through the EIP.

   For details about how to enable EIP protection, see Enabling Internet Border Traffic Protection.

2. Log in to the CFW console.
3. Click in the upper left corner of the management console and select a region or project.
4. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
5. In the navigation pane on the left, choose O&M Analysis > Traffic Center. Click the Outbound Traffic tab.
6. View traffic metrics intercepted or processed by the firewall on the Outbound Traffic tab.

   You can select a preset time range directly from the drop-down menu, or specify a custom window to analyze data across any period spanning from 5 minutes to 7 days.

   Table 1 Outbound traffic monitoring modules

   Module	Description
   Traffic Dashboard	Displays details about peak traffic volumes recorded when internal servers access the Internet within the specified time frame. Metrics include destination IP addresses, source IP addresses, destination ports, applications, and frequently accessed domain names.
   Outbound Traffic	Displays the outbound request and response traffic data captured during the specified time range. The data in this view reflects statistics processed only after sessions terminate; it does not represent real-time traffic. To check real-time traffic, view the Traffic Trend chart on the Dashboard page. For more details, see Cloud Firewall Dashboard. The values represent the average flow byte count of sessions that closed within that specific timestamp interval in the traffic logs, aggregated as follows: Last 1 hour: average value within every minute Last 24 hours: average value within every 5 minutes Last 7 days: average value within every hour Custom: 5 minutes to 6 hours: average value within every minute 6 hours (included) to 3 days: average value within every 5 minutes 3 (included) to 7 days (included): average value within every 30 minutes Hovering over any point on the trend chart displays the precise request and response traffic volumes for that specific timestamp. Click Select EIP to specify target EIPs in the slide-out panel. You can query up to 30 EIPs concurrently. By default, the chart displays both request and response traffic plots. You can toggle individual metrics on or off by clicking their legends.
   Top Statistics	Ranks and summarizes the top 5 destination IP addresses, source IP addresses, destination regions, domain names, outbound ports, and application distributions based on outbound traffic volume. Click Traffic or Accesses to switch between the chart metrics. Click a data point, value, or bar within a specific TOP chart. The system dynamically displays the detailed information page for that target data in a right-side slide-out panel.
   External IP Addresses	Lists traffic profiles categorized by destination IP address within the specified time frame. The table shows the top 1,000 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic. To block the traffic from an IP address, click Add to Blacklist in the Operation column to add it to the blacklist. CFW will directly block traffic from it. To export the external IP address list, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.
   External Domain Names	Lists traffic profiles categorized by domain name within the specified time frame. The table shows the top 1,000 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic. To export the external domain name list, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.
   Assets Initiating Internet Connections	Lists traffic profiles categorized by source EIPs within the specified time frame. The table shows up to 50 records with the highest traffic volumes. Each record includes the top five ports and applications with the highest access traffic. To export the list of assets initiating Internet connections, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.
   Assets Initiating Private Network Connections	Private IP address information is visible only to users who enable the VPC border firewall in the CFW professional edition. Lists traffic profiles categorized by private source IP addresses within the specified time frame. The table shows up to 50 records with the highest traffic volumes. Each record includes the top five ports and applications with the highest access traffic. To export the list of assets initiating private network connections, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.

References

• For details about how to view the statistics about the traffic from the Internet to the EIPs on the cloud, see Viewing Inbound Traffic.
• For details about how to check abnormal traffic, see What Can I Do If Services Cannot Be Accessed After a Policy Is Configured on CFW?
• For details about what to do when service traffic exceeds the protection bandwidth, see What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?