IP Location Top N

Prerequisites

Enable location statistics in Global Policy is enabled. For details, see Configuring Global Defense Policies.

Function

The IP Location Top N report provides visibility into the Top N IP locations that have the maximum volume of incoming or attack traffic.

NOTE:

Do not add user-defined IP locations to or delete them from an anti-DDoS device. Otherwise, the IP Location Top N report on the ATIC is inaccurate.

Parameter

Table 1 Query parameters of IP Location Top N
Parameter Description
Device Select a device from the drop-down list. Total-Cleaning and Total-Detecting are described as follows:

  • Total-Cleaning:

    Indicates that traffic on all cleaning devices is queried.

  • Total-Detecting:

    • If two or more detecting devices in a defense group work in Load Redundancy mode, the maximum traffic volume in the defense group is queried and the sum of traffic volumes among defense groups is queried.
    • If two or more detecting devices in each defense group work in Load Balancing mode, the sum of traffic volumes within each defense group and among defense groups is queried.
Zone Click , select a Zone on the Zone page that is displayed, and then click OK.
Statistical Dimension

The statistical dimensions are Global and China.
Time Click to select the start time and end time of statistics. Or you can change the time values in corresponding text boxes.

The end time should be later than the start time and the interval cannot be longer than one year.

  • If the query interval is longer than or equal to seven days and shorter than one year, statistics are collected daily.
  • If the query interval is longer than or equal to one day and shorter than seven days, statistics are collected hourly.
  • If the query interval is shorter than one day, statistics are collected every five minutes.
Traffic type

Select a traffic type. The traffic types are Incoming Traffic and Attack Traffic.

Incoming Traffic or Attack Traffic can be selected for anti-DDoS cleaning devices, and only Incoming Traffic can be selected for anti-DDoS detecting devices.
Unit

Select a traffic measurement unit. The unit can be pps or kbps. The default unit is pps.
Top N Enter the value of N.

Example

If the device is set to Total-Cleaning, zone to Total, traffic type to Incoming Traffic, top N IP locations that have the maximum incoming traffic in a specific period will be displayed, as shown in Figure 1.

Figure 1 IP Location Top N

Procedure

  1. Choose Report > Report > Traffic Analysis
  2. Click the IP Location Top N tab.
  3. Set query parameters.
  4. Click Search.

    The status of the top N IP locations that match the query conditions is displayed.

    NOTE:

    If a Zone has been deleted, the Zone name is displayed as Unknown Zone.

  5. Optional: Open or save the query results as files, or send queried reports to the specified email address.

    • Click to open or save the query results as PDF files. A maximum of 10,000 entries can be displayed.
    • Click to open or save the query results as EXCEL files. A maximum of 10,000 entries can be displayed.
    • Click to open or save the query results as CSV files. All data except figures can be displayed.
    • Click to enter a recipient mail address and select an attachment format. Then click OK.

Parent topic: Traffic Analysis
Copyright © Huawei Technologies Co., Ltd.