Viewing Inbound Traffic

Prerequisites

EIP protection is enabled and there is already traffic passing through the EIP. For details, see Enabling Internet Border Traffic Protection.

Viewing Inbound Traffic

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. Select a firewall from the drop-down list in the upper left corner of the page.
4. In the navigation pane, choose Traffic Analysis > Inbound Traffic.
5. On the Statistics Dashboard page of inbound traffic, check the traffic passing through the firewall within a time range, from 5 minutes to 7 days.
   • Traffic Dashboard: Information about the highest traffic from the Internet to internal servers.
     Figure 1 Inbound traffic - traffic dashboard
     
   • Inbound Traffic: Inbound request traffic and response traffic. The traffic statistics of up to 30 EIPs can be queried at a time.

     The data displayed is the average bits per second (bps) of the sessions ended at the specified time in traffic logs.

     Figure 2 Inbound traffic
     

     Table 1 Value description

     Time Range	Value
     Last 1 hour	Average value within every minute
     Last 24 hours	Average value within every 5 minutes
     Last 7 days	Average value within every hour
     Custom	5 minutes to 6 hours: average value within every minute 6 hours (included) to 3 days: average value within every 5 minutes 3 (included) to 7 days (included): average value within every 30 minutes

   • Visualizations: View the top 5 items ranked by specific parameters of inbound traffic within a specified period. For more information, see Table 2. You can click a data record to view the traffic details. A maximum of 50 data records can be viewed.
     Figure 3 Inbound traffic - visualized statistics
     

     Table 2 Inbound traffic parameters

     Parameter	Description
     Top Access Source IP Addresses	Source IP addresses of inbound traffic.
     Top Access Source Regions	Geographical locations of the source IP addresses of inbound traffic.
     Top Destination IP Addresses	Destination IP addresses of inbound traffic.
     Top Open Ports	Destination ports of inbound traffic.
     Top Application Distribution	Application information about inbound traffic.

6. Click the EIPs tab page. View traffic information about destination IP addresses.

   The table shows the top 50 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic.

   Figure 4 EIP analysis
   

7. Click the Source IP Addresses tab page. View traffic information about source IP addresses.
   • The table shows the top 50 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic.
   • Check whether the traffic is normal or malicious:
     • If the IP address is normal, click Add to Whitelist in the Operation column to add it to the whitelist. CFW will directly allow traffic from the IP address.
     • If the IP address is malicious, click Add to Blacklist in the Operation column to add it to the blacklist. CFW will directly block traffic from the IP address.
   Figure 5 Source IP address analysis
   

References

• For details about how to view the traffic from the EIP to the Internet, see Viewing Outbound Traffic.
• For details about how to check traffic exceptions, see What Can I Do If Services Cannot Be Accessed After a Policy Is Configured on CFW?
• For details about what to do if traffic exceeds the protection bandwidth, see What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?