The Traffic Center is divided into three pages based on outbound and inbound internet traffic and inter-VPC traffic patterns: Incoming Access Statistics, Outgoing Access, and VPC Firewall Activities. This document guides you on how to view traffic data across these three pages within the Traffic Center module and interpret the visualized information.
Incoming Access Statistics
Users can view specific IP addresses, number of visits, and traffic volume of inbound traffic on the Incoming Access Statistics page. They can also filter by region on the map to see access patterns to specific assets during different time periods, and view traffic rankings across regions.
Operation Steps
1. Log in to the CFW console. In the left sidebar, choose Traffic monitoring > Incoming Access Statistics.
2. In the filter box at the top of the Incoming Access Statistics page, select a specific asset to view its access patterns within the current region. You can also view traffic access data for different time periods (for example, last 24 hours or last 7 days).
3. Viewing external traffic access patterns to assets within both global and China regions on the map.
Select All regions to view the distribution of traffic access across countries worldwide.
Select China to view the distribution of traffic access across Chinese provinces.
Note:
The left carousel displays the top five countries/provinces based on traffic volume and number of visits. You can hover over the entries to view detailed IP address access information.
The color gradient on the map indicates traffic volume across regions (darker colors represent higher traffic). You can hover over specific provinces/countries to view detailed information.
The functions corresponding to the buttons on the right are: refreshing data in the carousel, resetting the map to its initial position, expanding the map, and zooming in/out on the map.
4. On the right side of the map, click
to view traffic access patterns in global mode.
5. In global mode, view rankings across different dimensions.
The left carousel on the map displays the top 10 countries/provinces based on traffic volume and number of visits.
The carousel on the right side of the map displays: the top 5 most frequently accessed ports, the distribution of external access protocols, the top 5 most frequently accessed assets, and the top 5 assets with the highest access traffic.
Note:
When a specific asset is selected, the right carousel will not display asset rankings.
The line chart below the map allows you to view the bandwidth rate of external access traffic within the current time range. It also supports viewing the inbound peak bandwidth and the total traffic volume over a 7-day or 24-hour period.
6. View the specific access IP information in the external access IP list at the bottom of the page.
Note:
Due to the large volume of traffic data, the list only displays the top 500 IP address access details by default.
This section introduces the features of the on the Incoming Access Statistics page as an example. The usage of other lists follows the same pattern.
6.1 In the External Address field of the External Access list, enter the precise source IP address. In the Destination Port field, enter the precise asset port. In the Location field, enter a precise or approximate location name. Then, click Reset filters to query traffic-related access details.
6.2 In the access list, you can view traffic logs, threat profiles, or asset details.
View traffic logs.
a. In the operation column on the right side of the target data, click Traffic Logs.
b. On the traffic logs page, you can view access details between specified IP addresses. Using the source and destination as filter criteria, you can display specific information about the same source accessing the same asset.
View threat profile.
a. In the operation column on the right side of the target data, choose More > Threat Profile.
b. On the threat profile page, view the threat profile information for that external address and proceed with further traceability auditing.
View asset details.
c. In the operation column on the right side of the target data, choose More > Asset Details.
c. On the asset details page, view security events and exposed asset information for that asset.
Outgoing Access
On the Outgoing Access page, you can view details of asset outbound connections in the last 7 days, including specific outbound traffic, outbound domains, and outbound addresses.
Operation Steps
1. Log in to the CFW console. In the left sidebar, choose Traffic monitoring > Outgoing Access.
On the Active Outgoing Access page, you can view the access status of outbound traffic within the last 7 days or 24 hours. You can also filter by time and asset to view Incoming Access Statistics for a specific asset within a given time period.
On the left side of the Active Outgoing Access page, you can view the outbound domains, destination addresses, and the number and alarm quantity of outbound assets. In the filter box at the top of the page, you can select a specific asset to view its outbound connection details.
You can view the bandwidth rate within the last 7 days or 24 hours via the line chart below, and hover the mouse over the line chart to see the bandwidth value at a specific point in time.
On the right side of the Active Outgoing Access page, you can view the top 5 domains with the most requests, the top 5 addresses with the most requests, the address with the highest access traffic, the top 5 assets with the most outbound connections, and the top 5 assets with the highest outbound traffic within the last 7 days or 24 hours.
2. In the list below, you can view the access status of the corresponding outbound traffic, outbound domain name, outgoing destination and external asset. For outbound domains, outbound addresses, and outbound assets, you can view their details.
3. Using outbound addresses as an example, the viewing method for other modules is the same. Click outgoing destinatio. In the operation column on the right side of the destination IP address, click Access Details to go to the Outgoing Access page.
4. On the Outgoing Access page, you can view information such as the number of accesses, access traffic volume, and the geographical location of the IP address for assets accessing that IP address within the last 7 days or 24 hours. You can also view which other assets have been accessed by that IP address in the list below. To learn about the traffic log and threat profile features, see Incoming Access Statistics.
5. To learn more about the outbound connections of a specific asset in the list, click Traffic Log or Access Details in the operation column on the right side of the instance list. You can then view the corresponding traffic log or the IP addresses and domains associated with the outbound connections of that specific asset within the last 7 days or 24 hours.
VPC Firewall Activities
You can view the traffic access and protocol distribution between private clouds on the VPC Firewall Activities page.
Operation Steps
1. Log in to the CFW console. In the left sidebar, choose Traffic monitoring> VPC Firewall Activities.
2. In the filter box at the top of the VPC Firewall Activities page, select the instance of a specific private cloud and the time period you want to view.
3. Hover the mouse pointer over the folding line graph for traffic statistics to view the bandwidth rate within a fixed period. You can also hover the mouse pointer over the protocol distribution pie chart on the right side to view the distribution percentage of each protocol.
4. You can view the specific IP addresses between VPCs at the bottom of the page, and also view the access destination, source, and number of IP accesses on the private cloud. To perform a precise search, enter the access source, destination, or destination port you want to query in the input box. For details, see Incoming Access Statistics.
Related Information
For issues related to Traffic Center, refer to the Bandwidth documentation.
