service feature

Blackholing Insights – analyze dropped DDoS traffic

Blackholing insights is currently a beta-feature and only available at DE-CIX Frankfurt. 

With Blackholing Insights, you get visual support when countering DDoS attacks while using Blackholing at DE-CIX. 

The tool shows you a variety of statistics and provides a peek into the traffic affected by the blackholing rules you have set. Traffic that is no longer visible to you – due to redirection (classical Blackholing) or filtering (Blackholing Advanced) – is visualized on the dashboard.

What you can analyze

The visualization is limited to the last hour of traffic going towards the prefixes with active Blackholing rules, and is automatically refreshed every 10 seconds. These statistics can help you to understand where a DDoS attack is coming from, whether the attack is still ongoing or attack parameters have changed, and what traffic is affected by your Blackholing setup.

Blackholing Insights shows you:

  • The highest rate of traffic that was seen during the last hour
  • A table of traffic mapped to specific blackholing rules
  • Traffic in bits per second and packets per second over the course of time
  • The top 15 peers the traffic towards your blackholed prefixes is coming from
  • The share of the traffic volume for the source and destination IPs in your blackholing traffic
  • The top source and destination ports
  • A heat map of the geographical distribution of the source of the traffic
  • The share of the traffic volume with respect to IP versions and protocols

Log in to see your stats

To take advantage of this free service, just log into the DE-CIX self-service portal to access your Blackholing Insights statistics. More information about what you can analyze can be also found in the portal in the Blackholing Insights documentation.