Open DDoS Mitigation → Traffic Capture in my.cubepath.com for real-time packet analysis of your protected IPs.

What it does

Traffic Capture shows the live packets arriving at your protected IPs and whether mitigation allowed (PASS) or blocked (DROP) them. It's the ground truth for three questions you can't answer from graphs:

  • What is this attack actually made of? Protocol, ports, packet size and source distribution tell you which vector you're facing.
  • Is my rule doing what I think? Add a rule, look at the log, confirm the traffic you meant to block shows DROP.
  • Am I blocking real customers? A DROP rate that jumps after a change, with sources that look like your users, is the answer before the support tickets arrive.

Viewing traffic

  1. 1
    Pick a time range
    From Last 5 min up to Last 24 hours.
  2. 2
    Select the IPs
    One or more Protected IPs, or leave All IPs.
  3. 3
    Set the interval (optional)
    The graph interval, from 10 seconds to 15 minutes.
  4. 4
    Search
    Click Search Packets to load the packet log.

The top cards show Total PASS, Total DROP, Protected IPs and Drop Rate, and the Traffic Overview chart plots PASS against DROP over time.

Filtering

Open Filters to narrow the results by Action (PASS/DROP), Protocol (TCP/UDP/ICMP), Source IP, Source Port and Destination Port (include or exclude), TCP Flags, Packet Size, TTL, and packets with a payload only.

The less obvious filters are the ones that identify an attack:

  • TCP flags — a flood of packets with only SYN set, and no completed handshakes, is a SYN flood.
  • Packet size — attack traffic is usually uniform and small; real traffic is varied.
  • TTL — a single TTL value across thousands of "different" sources suggests one origin spoofing many addresses.

What you get

The Packet Logs table lists each packet with its time, source and destination IP and port, protocol, action, flags, size, TTL and a payload preview. Source IPs show their country, and can be added straight to a prefix list.

Use Export to download the results as JSON — useful for an abuse report, or to hand to whoever is analysing the incident.