Viewing Inbound Traffic

Scenario

Inbound traffic analysis visualizes inbound traffic flowing from the Internet to your EIPs. It provides visibility into traffic trends, access sources, open ports, and application distribution. This capability allows you to quickly pinpoint single-hit connections, high-risk exposed ports, and high-frequency malicious source IP addresses, supporting use cases such as routine traffic inspections, security event investigations, and public network asset hardening.

This section describes how to view inbound traffic information.

Specification Limitations

• The data is collected from sessions. The statistics of a session is reported only after it is terminated.
• Traffic data is reported collectively after a session terminates. Consequently, persistent connections may experience a minor data display latency rather than real-time refreshes.
• Supported time ranges span from 5 minutes to 7 days. The system automatically adjusts the data aggregation granularity based on your selection. Custom intervals must be at least 5 minutes.
• The dashboard retains traffic statistics for the trailing 7 days only. For long-term retention, compliance audit, or advanced query, log stream forwarding to Log Tank Service (LTS) is required.
• You can select a maximum of 30 EIPs concurrently for batch analysis.
• The EIPs and Source IP Addresses analysis tables display up to 50 records by default. Within these records, only the top 5 ports and applications by traffic volume are shown.

Viewing the Inbound Traffic Dashboard

1. Enable EIP protection, and ensure that existing traffic passes through the EIP.

   For details about how to enable EIP protection, see Enabling Internet Border Traffic Protection.

2. Log in to the CFW console.
3. Click in the upper left corner of the management console and select a region or project.
4. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
5. In the navigation pane, choose Traffic Analysis > Inbound Traffic. The traffic dashboard of inbound traffic is displayed.
6. On the Statistics Dashboard page of inbound traffic, check the traffic passing through the firewall within a time range, from 5 minutes to 7 days.
   • Traffic Dashboard: Information about the highest traffic from the Internet to internal servers.
     Figure 1 Inbound traffic - traffic dashboard
     
   • Inbound Traffic: Inbound request traffic and response traffic. The traffic statistics of up to 30 EIPs can be queried at a time.

     The data displayed is the average bits per second (bps) of the sessions ended at the specified time in traffic logs.

     Figure 2 Inbound traffic
     

     Table 1 Value description

     Time Range	Value
     Last 1 hour	Average value within every minute
     Last 24 hours	Average value within every 5 minutes
     Last 7 days	Average value within every hour
     Custom	5 minutes to 6 hours: average value within every minute 6 hours (included) to 3 days: average value within every 5 minutes 3 (included) to 7 days (included): average value within every 30 minutes

   • Visualizations: View the top 5 items ranked by specific parameters of inbound traffic within a specified period. For more information, see Table 2. You can click a data record to view the traffic details. A maximum of 50 data records can be viewed.
     Figure 3 Inbound traffic - visualized statistics
     

     Table 2 Inbound traffic parameters

     Parameter	Description
     Top Access Source IP Addresses	Source IP addresses of inbound traffic.
     Top Access Source Regions	Geographical locations of the source IP addresses of inbound traffic.
     Top Destination IP Addresses	Destination IP addresses of inbound traffic.
     Top Open Ports	Destination ports of inbound traffic.
     Top Application Distribution	Application information about inbound traffic.

Analyzing EIPs

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane, choose Traffic Analysis > Inbound Traffic. Click the EIPs tab page.
5. View traffic information about destination IP addresses.
   • The table shows the top 50 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic.
   • To export the EIP list, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.
   Figure 4 EIP analysis
   

Analyzing Source IP Addresses

1. Log in to the CFW console.
2. Click in the upper left corner of the management console and select a region or project.
3. (Optional) Switch to another firewall instance. If there are multiple firewall instances, you can select a desired instance from the drop-down list in the upper left corner of the page.
4. In the navigation pane, choose Traffic Analysis > Inbound Traffic. Click the Source IP Addresses tab page.
5. View traffic information about source IP addresses.
   • The table shows the top 50 records with the highest access traffic. Each record includes the top five ports and applications with the highest access traffic.
   • Check whether the traffic is normal or malicious:
     • If the IP address is normal, click Add to Whitelist in the Operation column to add it to the whitelist. CFW will directly allow traffic from the IP address.
     • If the IP address is malicious, click Add to Blacklist in the Operation column to add it to the blacklist. CFW will directly block traffic from the IP address.
   • To export the source IP address list, click Export above the list and set the scope of data. The data will be automatically exported to the local PC.
   Figure 5 Source IP address analysis
   

References

• For details about how to view the traffic from the EIP to the Internet, see Viewing Outbound Traffic.
• For details about how to check abnormal traffic, see What Can I Do If Services Cannot Be Accessed After a Policy Is Configured on CFW?
• For details about what to do when service traffic exceeds the protection bandwidth, see What Do I Do If My Service Traffic Exceeds the Protection Bandwidth?