Open the DDoS Attacks page in my.cubepath.com to review every DDoS attack detected and mitigated against your IPs.
What this page shows
Each row is one attack event, newest first:
| Column | What it means |
|---|---|
| Target IP | The protected IP that was hit. Click it to jump to DDoS Mitigation filtered on that address |
| Description | The detected attack vector |
| Start Time | When it began, shown in UTC |
| Duration | How long it lasted, in seconds |
| Peak Rate | Peak packet rate in Mpps (millions of packets per second) |
| Peak Traffic | Peak bandwidth in Gbps |
| Status | finished for an attack that ended; anything else is still ongoing |
NoteHover the start time to see the full UTC timestamp, and hover a long description to read it in full.
Reading the two peak numbers together
Mpps and Gbps describe different attacks, and the ratio between them tells you which one you had:
- High Gbps, moderate Mpps — a volumetric flood of large packets, aiming to saturate the link. Amplification attacks look like this.
- High Mpps, modest Gbps — a packet-rate attack of tiny packets, aiming to exhaust processing rather than bandwidth. A SYN flood looks like this, and it can take down a server whose link is barely busy.
That distinction is why "we weren't near our bandwidth limit" isn't evidence that an attack didn't hurt.
Attack details
Expand a row with the arrow on the left for a breakdown of the traffic as pie charts by country, ASN, source IP, packet length and source port.
This is where an attack becomes actionable. A single dominant ASN or country can be filtered in a protection profile; a concentrated set of source IPs belongs in a prefix list; a single source port usually identifies the amplification protocol being abused.
Use the graph action on a row to open the traffic graph for that attack and see how the volume developed over the event.
Searching
The search box matches on IP address, description, status, duration and attack ID, with a counter showing how many attacks match.
NoteAn empty list means no DDoS attacks have been recorded against your IPs.
TipRead this page even when nothing broke. Attacks that mitigation absorbed silently still tell you which of your addresses are being targeted, and that's worth knowing before one arrives that's big enough to notice.