Viewing Inbound Traffic

Scenario

Inbound traffic analysis visualizes inbound traffic flowing from the Internet to your EIPs. It provides visibility into traffic trends, access sources, open ports, and application distribution. This capability allows you to quickly pinpoint single-hit connections, high-risk exposed ports, and high-frequency malicious source IPs, supporting use cases such as routine traffic audits, security event investigations, and public network asset hardening.

This section describes how to monitor and view inbound traffic information.

For instructions on viewing the global traffic topology visualization, which details VPC border, and Internet border information for all cloud assets, see Cloud Firewall Dashboard.

Constraints

• The data is collected from sessions. The statistics of a session is reported only after it is terminated.
• Traffic data is reported collectively after a session terminates. Consequently, persistent connections may experience a minor data display latency rather than real-time refreshes.
• Supported time ranges span from 5 minutes to 7 days. The system automatically adjusts the data aggregation granularity based on your selection. Custom intervals must be at least 5 minutes.
• The dashboard retains traffic statistics for the trailing 7 days only. For long-term retention, compliance audit, or advanced query, log stream forwarding to Log Tank Service (LTS) is required.
• You can select a maximum of 30 EIPs concurrently for batch analysis.
• The EIPs and Source IP Addresses analysis tables display up to 50 records by default. Within these records, only the top 5 ports and applications by traffic volume are shown.

Viewing Inbound Traffic

1. Enable EIP protection, and ensure that existing traffic passes through the EIP.

   For details about how to enable EIP protection, see Enabling Internet Border Traffic Protection.

2. Log in to the CFW console.
3. Click in the upper left corner of the management console and select a region or project.
4. In the navigation pane on the left, choose O&M Analysis > Traffic Center. The Inbound Traffic tab is displayed by default.
5. View traffic metrics intercepted or processed by the firewall on the Inbound Traffic tab.

   You can select a preset time range directly from the drop-down menu, or specify a custom window to analyze data across any period spanning from 5 minutes to 7 days.

   Table 1 Inbound traffic monitoring modules

   Module	Description
   Traffic Dashboard	Displays details about peak traffic volumes recorded when Internet clients access internal servers within the specified time frame. Metrics include destination IP addresses, source IP addresses, destination ports, applications, access source regions, and the total count of external ports.
   Inbound Traffic	Displays the inbound request and response traffic data captured during the specified time range. The data in this view reflects statistics processed only after sessions terminate; it does not represent real-time traffic. To check real-time traffic, view the Traffic Trend chart on the Dashboard page. For more details, see Cloud Firewall Dashboard. The values represent the average flow byte count of sessions that closed within that specific timestamp interval in the traffic logs, aggregated as follows: Last 1 hour: average value within every minute Last 24 hours: average value within every 5 minutes Last 7 days: average value within every hour Custom: 5 minutes to 6 hours: average value within every minute 6 hours (included) to 3 days: average value within every 5 minutes 3 (included) to 7 days (included): average value within every 30 minutes Hovering over any point on the trend chart displays the precise request and response traffic volumes for that specific timestamp. Click Select EIP to specify target EIPs in the slide-out panel. You can query up to 30 EIPs concurrently. By default, the chart displays both request and response traffic plots. You can toggle individual metrics on or off by clicking their legends.
   Top Statistics	Ranks and summarizes the top 5 source IP addresses, destination IP addresses, source regions, open ports, and application distributions based on inbound traffic volume. Click Traffic or Accesses to switch between the chart metrics. Click a data point, value, or bar within a specific TOP chart. The system dynamically displays the detailed information page for that target data in a right-side slide-out panel.
   Source IP Addresses	Lists traffic profiles categorized by originating source IP address. The table shows up to 50 records with the highest traffic volumes. Each record includes the top five ports and applications with the highest access traffic. Check whether the traffic is normal or malicious: If the IP address is normal, click Add to Whitelist in the Operation column to add it to the whitelist. CFW will directly allow traffic from the IP address. If the IP address is malicious, click Add to Blacklist in the Operation column to add it to the blacklist. CFW will directly block traffic from the IP address. To export the source IP address list, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.
   EIPs	Lists traffic profiles categorized by target destination IP address. The table shows up to 50 records with the highest traffic volumes. Each record includes the top five ports and applications with the highest access traffic. To export the EIP list, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.

References

• For details about how to view the traffic from the EIP to the Internet, see Viewing Outbound Traffic.
• For details about how to check abnormal traffic, see What Can I Do If Services Cannot Be Accessed After a Policy Is Configured on CFW?
• For details about what to do when service traffic exceeds the protection bandwidth, see What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?