A Distributed Denial-of-Service (DDoS) attack is a malicious attempt to disrupt your services. By default, Alibaba Cloud enables Global Accelerator free of charge for the accelerated IP addresses and public IP addresses of endpoint groups in a Global Accelerator instance. This service defends against malicious attacks, improving the security and resilience of your Global Accelerator instance.
How it works
Protection capability
Anti-DDoS Basic is enabled by default for the accelerated IP addresses and the public IP addresses of endpoint groups in a Global Accelerator instance, providing basic DDoS protection of up to 5 Gbps. The free protection capacity varies by region:
For the default blackhole trigger thresholds for Anti-DDoS Basic in different regions, see Anti-DDoS Basic blackhole thresholds.
The actual blackhole threshold for a Global Accelerator instance depends on its region and bandwidth configuration. The value displayed on the Asset page prevails.
Protection mechanism
All traffic from the internet is routed through a DDoS protection network before it reaches the Global Accelerator instance. The DDoS protection network monitors traffic that enters the Global Accelerator instance in real time. When the network detects an abnormally large volume of traffic or other abnormal traffic such as a DDoS attack, Anti-DDoS Basic redirects the suspicious traffic from the original network path to scrubbing devices. This redirection occurs without affecting your normal services. The scrubbing devices identify and remove malicious traffic. The remaining legitimate traffic is then injected back into the original network and forwarded to the target Global Accelerator instance. This process is called traffic scrubbing.
If inbound traffic exceeds the protection capacity, it is routed to a blackhole to protect the entire cluster. All inbound traffic is then dropped. For more information, see Alibaba Cloud blackhole policy.
Traffic scrubbing is triggered by the following conditions:
Traffic pattern: Traffic matches the signature of a known attack model.
Traffic volume: Anti-DDoS Basic automatically sets a scrubbing threshold based on the bandwidth of the accelerated IP address and the public IP address of the endpoint group. When traffic reaches this threshold, traffic scrubbing begins, even if the traffic is legitimate.
Traffic scrubbing methods include filtering attack packets, rate-limiting traffic, and rate-limiting packets. Anti-DDoS Basic uses the following scrubbing thresholds:
BPS scrubbing threshold: Scrubbing begins when the inbound traffic rate, in bits per second, exceeds this threshold.
PPS scrubbing threshold: Scrubbing begins when the number of inbound packets per second exceeds this threshold.
Scrubbing thresholds
The scrubbing thresholds for the accelerated IP addresses and public IP addresses of endpoint groups in a Global Accelerator instance are shown in the following tables:
Table 1. Maximum BPS scrubbing threshold
IP bandwidth (Mbps) | Max BPS threshold (Mbps) |
≤300 | 450 |
>300 | IP bandwidth × 1.5 |
Table 2. Maximum PPS scrubbing threshold
IP bandwidth (Mbps) | Max PPS threshold (pps) |
≤100 | 100,000 |
>100 | IP bandwidth × 1,000 |
The IP bandwidth is calculated as follows:
IP bandwidth of an accelerated IP address: the bandwidth value allocated to the acceleration area.
The bandwidth value for the public IP address of an endpoint group is determined by the billing method and bandwidth metering method of the Global Accelerator instance.
Billing method
Bandwidth metering method
IP bandwidth
subscription
Pay-by-bandwidth (associated with a basic bandwidth plan)
Peak bandwidth of the basic bandwidth plan
pay-as-you-go
Pay-by-data-transfer (settled by CDT)
1,200 Mbps
For example, consider a standard Global Accelerator instance where the accelerated IP address has 100 Mbps of bandwidth allocated to its acceleration area, and the associated basic bandwidth plan has a peak bandwidth of 200 Mbps.
Protection thresholds for the accelerated IP address: The maximum BPS scrubbing threshold is 450 Mbps, and the maximum PPS scrubbing threshold is 100,000 pps.
Protection thresholds for the public IP address of the endpoint group: The maximum BPS scrubbing threshold is 450 Mbps, and the maximum PPS scrubbing threshold is 200,000 pps.
View Global Accelerator's protection threshold
Log on to the GA console.
On the Instances page, click the instance ID.
NoteTo view the protection thresholds for a basic Global Accelerator instance, choose Basic GA Instance from the left-side navigation pane in the Global Accelerator console to open the list of basic instances.
View the protection threshold for a Global Accelerator instance's accelerated IP address or its endpoint's public IP address.
NoteThe DDoS protection status can be Protected, Scrubbing, or Blackhole Filtering. The color of the DDoS protection icon varies based on the status. Details are available in the tooltip.
Accelerated IP address
On the instance details page, click the Acceleration Areas tab and find the target accelerated IP address. In the Security Protection column, hover over the DDoS protection icon. The tooltip shows the BPS scrubbing threshold, PPS scrubbing threshold, and blackhole threshold for the accelerated IP address.
Endpoint group public IP
This section applies only to standard Global Accelerator instances.
On the instance details page, click the Listeners tab, and then click the ID of the listener for the target endpoint group.
On the listener details page, click the Endpoint Group tab. Find the target endpoint group with the public IP address and hover over the DDoS protection icon. The tooltip shows the BPS scrubbing threshold, PPS scrubbing threshold, and blackhole threshold for the public IP address of the endpoint group.
Related operations
Configure scrubbing thresholds: By default, Global Accelerator applies the maximum Anti-DDoS Basic protection threshold based on the IP bandwidth. However, the maximum BPS scrubbing threshold can be too high for effective protection with certain IP bandwidths. Therefore, you should adjust the scrubbing threshold to meet your business needs. For more information, see Configure traffic scrubbing thresholds.
Purchase other DDoS protection services: Anti-DDoS Basic provides only basic security. If you require stronger protection, you can associate your Global Accelerator instance with Anti-DDoS Origin or Anti-DDoS Pro/Premium.