CubePathDOCS

DDoS Mitigation

Query Traffic Capture

post/ddos-mitigation/traffic-capture

Query captured traffic logs for one of your protected IPs.

The destination IP or subnet must belong to your organization. Only the traffic from the periods in which your organization held it with Premium protection is returned. Returns packet-level data for DDoS analysis.

Authorization

Authorization
Authorization*string

Bearer YOUR_API_TOKEN with an API token. The X-API-Key: YOUR_API_TOKEN header works too.

Request body

Filters for traffic capture query.

application/jsonRequired
start_time*string
Formatdate-time
end_time*string
Formatdate-time
destination_ip*string

IP or subnet to query (must belong to your organization)

include_src_ips?array<string>
Rangeitems ≤ 10
exclude_src_ips?array<string>
Rangeitems ≤ 10
include_src_ports?array<integer>
exclude_src_ports?array<integer>
include_dst_ports?array<integer>
exclude_dst_ports?array<integer>
min_src_port?integer | null
Range1 ≤ value ≤ 65535
max_src_port?integer | null
Range1 ≤ value ≤ 65535
min_dst_port?integer | null
Range1 ≤ value ≤ 65535
max_dst_port?integer | null
Range1 ≤ value ≤ 65535
include_protocols?array<string>
exclude_protocols?array<string>
include_actions?array<string>
exclude_actions?array<string>
include_tcp_flags?array<string>
exclude_tcp_flags?array<string>
min_packet_len?integer | null
Range0 ≤ value
max_packet_len?integer | null
Range0 ≤ value
min_ttl?integer | null
Range0 ≤ value ≤ 255
max_ttl?integer | null
Range0 ≤ value ≤ 255
has_payload?boolean | null

Filter packets with/without payload

limit?integer
Range1 ≤ value ≤ 100000Default20000

Responses

Successful Response

application/json

start_time*string
end_time*string
total_logs*integer
logs*array<TrafficLog>
Properties (19)
timestamp*string
node?string | null
src_ip*string
dst_ip*string
src_port*integer
dst_port*integer
protocol*string
action*string
mitigation_name?string | null
is_drop*boolean
packet_len*integer
ttl*integer
sample_rate?integer | null
tcp_flags?string | null
icmp_type?integer | null
icmp_code?integer | null
src_country?string | null
payload_len?integer | null
payload?string | null