Viewing Inter-VPC Access Traffic

Scenario

Inter-VPC access analysis visualizes cross-VPC traffic trends, ranks top source/destination IP addresses, ports, and applications, and provides detailed private network access logs. This capability supports use cases such as bandwidth capacity planning, anomalous traffic tracking, internal lateral movement risk detection, and statutory compliance audits.

This section describes how to monitor and view inter-VPC traffic data protected by the current firewall instance.

For instructions on viewing the global traffic topology visualization, which details VPC border, and Internet border information for all cloud assets, see Cloud Firewall Dashboard.

Constraints

• The data is collected from sessions. The statistics of a session is reported only after it is terminated.
• Traffic data is reported collectively after a session terminates. Consequently, persistent connections may experience a minor data display latency rather than real-time refreshes.
• Supported time ranges span from 5 minutes to 7 days. The system automatically adjusts the data aggregation granularity based on your selection. Custom intervals must be at least 5 minutes.

Viewing Inter-VPC Access Traffic

1. Configure and enable VPC border traffic protection, and ensure that existing traffic passes through the VPC.

   For details about how to enable VPC border traffic protection, see Enabling VPC Border Traffic Protection.

2. Log in to the CFW console.
3. Click in the upper left corner of the management console and select a region or project.
4. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
5. In the navigation pane on the left, choose O&M Analysis > Traffic Center. Click the Inter-VPC Access tab.
6. View traffic metrics intercepted or processed by the firewall on the Inter-VPC Access tab.

   You can select a preset time range directly from the drop-down menu, or specify a custom window to analyze data across any period spanning from 5 minutes to 7 days.

   Table 1 Inter-VPC access traffic monitoring modules

   Module	Description
   Traffic Dashboard	Displays details about peak traffic volumes recorded between VPCs within the specified time frame. Metrics include source IP addresses, destination IP addresses, access ports, and active applications.
   Inter-VPC Access	Displays the request and response traffic data captured between VPCs during the specified time range. The data in this view reflects statistics processed only after sessions terminate; it does not represent real-time traffic. To check real-time traffic, view the Traffic Trend chart on the Dashboard page. For more details, see Cloud Firewall Dashboard. The values represent the average flow byte count of sessions that closed within that specific timestamp interval in the traffic logs, aggregated as follows: Last 1 hour: average value within every minute Last 24 hours: average value within every 5 minutes Last 7 days: average value within every hour Custom: 5 minutes to 6 hours: average value within every minute 6 hours (included) to 3 days: average value within every 5 minutes 3 (included) to 7 days (included): average value within every 30 minutes Hovering over any point on the trend chart displays the precise request and response traffic volumes for that specific timestamp. By default, the chart displays both request and response traffic plots. You can toggle individual metrics on or off by clicking their legends.
   Top Statistics	Ranks and summarizes the top 5 destination IP addresses, source IP addresses, access ports, and application distributions based on inter-VPC traffic volume. Click Traffic or Accesses to switch between the chart metrics. Click a data point, value, or bar within a specific TOP chart. The system dynamically displays the detailed information page for that target data in a right-side slide-out panel.
   Private IP Address Accesses	Lists traffic profiles categorized by private IP addresses within the specified time frame. The table shows the top 50 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic. To export the private network IP address list, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.

References

• For details about how to check abnormal traffic, see What Can I Do If Services Cannot Be Accessed After a Policy Is Configured on CFW?
• For details about what to do when service traffic exceeds the protection bandwidth, see What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?