Skip to main content
This guide provides you with the necessary information to understand, monitor, and manage DDoS protection on their assigned IPs and services using the NaaS Platform. The NaaS Platform offers real-time, automated mitigation to ensure service continuity during DDoS attacks.
1. Introduction
The DynamicLink DDoS Protection service continuously monitors your internet-facing connections and automatically blocks large-scale DDoS attacks. As a user, you will interact with a user-friendly interface to view and manage your protection based on pre-defined rules set by the operator.
Figure 1: A high-level diagram showing how traffic is monitored and mitigated.
2. Access Requirements
To effectively use the DDoS protection service, ensure you meet the following requirements:
- Valid tenant credentials: Provided by your system administrator.
- Network familiarity: Understanding of IP ranges and hosted services.
- Basic knowledge of common DDoS attack types.
3. Key Concepts
Familiarize yourself with these core concepts:
- Mitigation Status: Indicates whether an IP is currently under protection.
- Thresholds: Limits set by the system administrator that trigger mitigation.
- DUA (Device Under Attack): Your IP currently being targeted by an attack.
- False Positive: Legitimate traffic mistakenly flagged as an attacker.
- Per IP Visibility: Each IP is tracked individually for accurate mitigation.
4. Enterprise Portal Overview
The Portal is your central hub for monitoring protected services.
Figure 2: The Tenant Portal Dashboard displaying real-time activity.
- Dashboard: Displays real-time and historical DDoS activity, active threats, protected IPs, and mitigation activity.
- Traffic View: Shows traffic trends per IP, both historical and real-time.
- Thresholds: Can be reviewed and, if permitted, adjusted.
- Logs: Available for download and review.
- Alerts: Notify you of detected threats and mitigation actions.
5. Daily Operations
Follow these steps for routine monitoring and management:
5.1. Monitor Traffic
- Log in to the NaaS portal.
- Open Dashboard ⇒ Live View.
- Observe per IP trends and spikes.
5.2. Review Alerts
- Navigate to Alert ⇒ Recent Events.
- Filter by IP or timestamp.
- Acknowledge resolved alerts.
5.3. Export Reports
- Go to Logs ⇒ Export.
- Select format: CSV, JSON.
- Download for compliance use.
6. How to Use DDoS Protection
As a tenant, you have a simplified view of DDoS protection. Most complex logic is handled by your provider, but you can manage basic settings.
6.1. Know Which Rules Apply to You
- Tenant Global Rules: Always on and cannot be changed.
- Tenant Template Rules: Can be enabled/disabled or switched to monitor mode if the option is provided.
- Tenant Specific Rules: Custom rules unique to your organization.
6.2. Manage Your Rules
- Go to NaaS portal ⇒ Services ⇒ DDoS display screen.
- View the available rules, each with a name and description.
- If a rule has options:
- You may enable or disable it.
- You may switch it to monitor mode to observe attacks without blocking.
- You may apply the rule to specific IPs or subnets in your network.
7. DDoS Statistics
Access detailed DDoS statistics to monitor and analyze attack trends.
7.1. Accessing DDoS Statistics
- Log in to the NaaS portal.
- Go to the left navigation panel ⇒ Click on Service.
- Select DDoS.
- The statistics dashboard will be displayed.
Figure 5: The main DDoS statistics dashboard.
7.2. Top Summary Section
- Status: Real-time indicator (e.g., “No Attack” - green means no attack detected).
- Attack in last 7 days: Displays total mitigated traffic (in GB) and peak mitigation rate (in Mbps).
- Target & Mitigation Rate: Shows mitigation success rate (%) and unique attack targets over the past 7 days.
- DDoS Status Summary: Breakdown of current system status (Active Mitigation, Monitor Only, Disabled).
- Last Attack: Timestamp of the most recent detected attack.
7.3. Dashboard Tabs & Filter
- Tab (General/Attack Details):
- General: Summary view of traffic, attack patterns, and mitigated flows.
- Attack Details: Detailed session breakdown.
- Filter Panel: Apply filters by fields like Rule Name, DIA Name, Target IP.
- CSV: Export DDoS attack data for offline analysis.
7.4. Graph and Charts
- Total Incoming and Mitigation Traffic (Top Graph):
- Green area: Successfully mitigated traffic.
- Red Line: Unblocked attack traffic that passed through.
- Blue Line: Total incoming traffic.
- Use this to compare actual threats and mitigation effectiveness.
- Observed Traffic by Traffic Name: Traffic classification by protocol or service (e.g., DNS, ICMP, UDP Flood). Helps identify the nature of attack or abnormal traffic flow.
- Observed Traffic By Rule Name: Shows what traffic was flagged by which DDoS rule (e.g., ICMP_Flood, TCP_SYN). Useful for reviewing rule effectiveness.
7.5. Visualization Panels (Right Side)
-
Attack per IP (Bar Chart): Horizontal bar showing targeted IP addresses and attack volume per IP.
-
Observed Traffic By Rule (Pie Chart): Breakdown of mitigated traffic by DDoS rule type.
Figure 7: Visualization panels showing attack distribution by IP and rule type.
-
Live Update Indicator: Message like “No attack traffic observed (last 30 seconds)” shows the current state of threat in near real time.
7.6. Time Selection (Top Right)
- Use the dropdown to change data granularity (Auto, 30s, 1m, 5m, 1h).
- Allows switching between BPS (Bits Per Second) and PPS (Packet Per Second).
- Time range: Last hour/last 7 days.
8. Use Case Scenarios
8.1. Use Case 1: SYN Flood Attack
- An alert is triggered on one of your web servers.
- Mitigation is automatically applied.
- You view affected IP and traffic patterns in real-time.
- Download a report for internal analysis.
Figure 8: A diagram showing the workflow during a SYN Flood Attack scenario.
8.2. Use Case 2: UDP Reflection Attack
- You observe a sharp rise in UDP traffic from random sources.
- Mitigation is visible, and traffic is filtered.
- You confirm no DNS/NTP service degradation.
