Anti-DDoS Origin Basic is a free service that protects your ECS instances from DDoS attacks. When inbound traffic to an ECS instance exceeds the limit of its instance type, Security Center throttles the traffic to prevent data leaks, server disconnections, and service unavailability. This topic describes the features and principles of Anti-DDoS Origin Basic.
By default, Security Center provides up to 5 Gbps of free attack mitigation for ECS instances. The specific protection capacity varies by instance type. You can view the actual protection thresholds in the Traffic Security console. For more information, see What is Security Center and Anti-DDoS Origin Basic blackhole thresholds.
Traffic scrubbing
After you enable Anti-DDoS Origin Basic, Security Center monitors inbound traffic to your ECS instances in real time. If it detects large volumes of traffic or abnormal traffic, including DDoS attacks, Security Center redirects the suspicious traffic to a scrubbing center without impacting your services. The scrubbing center filters out malicious traffic and forwards the legitimate traffic to the target ECS instance. This process is called traffic scrubbing. This process removes abnormal traffic to ensure the stability and security of your services. For more information, see What is Anti-DDoS Origin.
If inbound internet traffic to an ECS instance exceeds 5 Gbps, Alibaba Cloud blackholes the instance to protect the entire cluster. All traffic to the instance is then dropped, and all public access is blocked. For more information, see Alibaba Cloud blackhole policy.
Traffic scrubbing triggers
Traffic scrubbing is triggered under the following conditions:
-
Traffic patterns: Scrubbing is triggered when inbound traffic matches the signature of a known attack.
-
Traffic volume: DDoS attacks typically involve massive traffic, often measured in Gbps. Scrubbing is automatically triggered when inbound traffic to an ECS instance exceeds a predefined threshold.
Traffic scrubbing methods
Anti-DDoS Origin Basic uses methods such as filtering attack packets and rate-limiting traffic. You can configure these methods using the following thresholds. For instructions, see Set traffic scrubbing thresholds.
-
BPS-based scrubbing threshold: Triggers traffic scrubbing when the inbound traffic rate, measured in bits per second (BPS), exceeds this value.
-
PPS-based scrubbing threshold: Triggers traffic scrubbing when the inbound packet rate, measured in packets per second (pps), exceeds this value.
Scrubbing thresholds for ECS instances
This feature is available in the following regions: China (Heyuan), China (Guangzhou), China (Chengdu), China (Hohhot), China (Ulanqab), China (Hong Kong), UAE (Dubai), UK (London), Germany (Frankfurt), Philippines (Manila), Malaysia (Kuala Lumpur), Indonesia (Jakarta), Japan (Tokyo), US (Virginia), US (Silicon Valley), and Singapore.
The scrubbing thresholds for an ECS instance depend on its purchased public bandwidth and instance type. The calculation formulas are shown in the following table.
|
Purchased bandwidth (Mbps) |
Maximum BPS threshold (Mbps) |
Maximum PPS threshold (pps) |
|
≤300 |
The lesser of the instance type's maximum network bandwidth and 450. |
The lesser of the maximum packet forwarding rate of the instance type and 100,000. |
|
>300 |
The lesser of the maximum network bandwidth of the instance type and (Purchased public bandwidth * 1.5). |
The lesser of the maximum packet forwarding rate of the instance type and (Purchased public bandwidth * 1,000). |
-
The BPS and PPS thresholds use the values from the Network Bandwidth and Packet forwarding rate columns in the instance family documentation, respectively.
-
Some instance families do not provide bandwidth metrics. In this case, the scrubbing thresholds displayed in the Traffic Security console prevail.
-
The blackhole threshold displayed in the Traffic Security console prevails. For more information, see Anti-DDoS Origin Basic blackhole thresholds.
For example, consider an ecs.g5.16xlarge instance with a purchased public bandwidth of 100 Mbps. This instance type has a maximum network bandwidth of 20,000 Mbps and a maximum packet forwarding rate of 4,000,000 pps. The scrubbing thresholds are calculated as shown in the following table.
|
Purchased bandwidth (Mbps) |
Maximum BPS threshold (Mbps) |
Maximum PPS threshold (pps) |
|
100 < 300 |
MIN(20,000, 450) The result is 450. |
MIN(4,000,000, 100,000) The result is 100,000. |
The Traffic Security console displays the actual scrubbing thresholds. For more information, see Assets. For example, log on to the Traffic Security console, go to the Assets page, and click the ECS tab. The BPS and PPS scrubbing thresholds for each instance are displayed in the Scrubbing Threshold column.
Related topics
Anti-DDoS Origin Basic is enabled by default for all ECS instances. After you create an instance, you can perform the following operations:
-
Set traffic scrubbing thresholds: By default, an ECS instance uses the maximum thresholds allowed for its instance type. However, for some instance types, the maximum BPS-based threshold may be too high for your services. You should adjust the thresholds to meet your service requirements. For instructions, see Anti-DDoS Origin Basic User Guide - Anti-DDoS Origin Basic settings.
-
(Not recommended) Cancel traffic scrubbing: Security Center scrubs traffic that reaches the scrubbing threshold, even if the traffic is legitimate, which can affect your services. You can manually cancel traffic scrubbing to ensure service availability. For instructions, see Anti-DDoS Origin Basic User Guide - How to cancel traffic scrubbing.
WarningAfter you cancel traffic scrubbing, if inbound traffic to the ECS instance exceeds its blackhole threshold (up to 5 Gbps), the instance is blackholed. Proceed with caution.
-
Upgrade to Anti-DDoS Pro: Compared to traditional DDoS protection solutions, Anti-DDoS Pro offers advantages, including easy deployment, a high-quality BGP network, powerful protection, high stability, and precise, AI-powered mitigation. For more information, see What is Anti-DDoS Pro.
-
To learn how to choose a DDoS protection product, see How to choose a DDoS protection product.