---
title: "DDoS Attacks"
description: "Review every DDoS attack detected against your IPs, with duration, peak rate, traffic breakdown by country, ASN and source."
category: "Security"
language: en
source: https://cubepath.com/docs/products/security/ddos-attacks
updated: 2026-08-04
---

# DDoS Attacks

Open the **DDoS Attacks** page in [my.cubepath.com](https://my.cubepath.com) to review every DDoS attack detected and mitigated against your IPs.

## What this page shows

Each row is one attack event, newest first:

| Column | What it means |
|--------|---------------|
| **Target IP** | The protected IP that was hit. Click it to jump to [DDoS Mitigation](/docs/products/security/ddos-mitigation) filtered on that address |
| **Description** | The detected attack vector |
| **Start Time** | When it began, shown in **UTC** |
| **Duration** | How long it lasted, in seconds |
| **Peak Rate** | Peak packet rate in **Mpps** (millions of packets per second) |
| **Peak Traffic** | Peak bandwidth in **Gbps** |
| **Status** | `finished` for an attack that ended; anything else is still ongoing |

> Note: Hover the start time to see the full UTC timestamp, and hover a long description to read it in full.

## Reading the two peak numbers together

**Mpps** and **Gbps** describe different attacks, and the ratio between them tells you which one you had:

- **High Gbps, moderate Mpps** — a volumetric flood of large packets, aiming to saturate the link. Amplification attacks look like this.
- **High Mpps, modest Gbps** — a packet-rate attack of tiny packets, aiming to exhaust processing rather than bandwidth. A SYN flood looks like this, and it can take down a server whose link is barely busy.

That distinction is why "we weren't near our bandwidth limit" isn't evidence that an attack didn't hurt.

## Attack details

Expand a row with the arrow on the left for a breakdown of the traffic as pie charts by **country**, **ASN**, **source IP**, **packet length** and **source port**.

This is where an attack becomes actionable. A single dominant ASN or country can be filtered in a [protection profile](/docs/products/security/ddos-mitigation); a concentrated set of source IPs belongs in a [prefix list](/docs/products/security/prefix-lists); a single source port usually identifies the amplification protocol being abused.

Use the **graph** action on a row to open the traffic graph for that attack and see how the volume developed over the event.

## Searching

The search box matches on IP address, description, status, duration and attack ID, with a counter showing how many attacks match.

> Note: An empty list means no DDoS attacks have been recorded against your IPs.

> Tip: Read this page even when nothing broke. Attacks that mitigation absorbed silently still tell you which of your addresses are being targeted, and that's worth knowing before one arrives that's big enough to notice.