Configuring a Blackhole Triggered Within Seconds

There are two modes for the blackhole triggered within seconds: Automatic and Third-party:

If Automatic is selected, after detecting that the traffic of a destination IP address exceeds the blackhole threshold, the anti-DDoS device immediately reports a blackhole alarm to the ATIC. After receiving the alarm, the ATIC delivers a blackhole policy to the anti-DDoS device based on the configured blackhole type.
If Third-party is selected, after detecting that the traffic of a destination IP address exceeds the blackhole threshold, the anti-DDoS device sends a syslog to the third-party device, and the third-party device performs the blackhole operation.

Automatic

Choose Defense > Policy Settings > Global Policy .
Click .
In the Attack Defense Configuration dialog box, set Notification Mode of Second-level blackhole Event to Sending Alert to ATIC.
Click OK.

Associate the defense mode of the Zone.

In the Defense Policy dialog box, set Blackhole Threshold parameters. For the parameter description, see Table 1.

**Table 1** Blackhole
Parameter	Description
Enabled	Blackhole parameters can be set only after Enabled is selected.
Threshold (Mbit/s)	If traffic exceeds the specified Threshold (Mbit/s), the corresponding blackhole type is enabled to defend against the attack traffic.
LPU blackhole	If LPU blackhole is selected, the ATIC delivers a hardware blocking policy to the anti-DDoS device for the to-be-blackholed IP address. The LPU executes the blackhole policy for this IP address. NOTE: Only the AntiDDoS8000 that have the LPU240 or LPU120 installed support this mode.
Routing Blackhole	If Routing Blackhole is selected, the ATIC delivers a route whose next hop is NULL 0 to the anti-DDoS device. The anti-DDoS device advertises this route to the upstream blackhole router through BGP. The upstream router executes the blackhole policy for this IP address. NOTE: The upstream router and the BGP peer between the upstream router and anti-DDoS device must be configured in advance.

Third-party execution
1. Choose Defense > Policy Settings > Global Policy.
2. Click .
3. In the Defense Policy dialog box, set Notification Mode of Second-level blackhole Event to Sending SYSLOG to the 3rd System.
4. Click OK.
5. In the system view of the anti-DDoS device, run the following command to set the IP address for receiving syslogs.
```
anti-ddos host-traffic-overflow syslog enable
```
```
info-center source DDOS channel channel log level critical
```
```
info-center loghost  ip-address channel channel
```
  ip-address specifies the IP address of the third-party system that receives syslogs.