Follow

How to Use the DDoS Dashboard in Portal

Description

The DDoS Dashboard shows the volume of network traffic flowing through the Silverline infrastructure in bits per second (bps) or packets per second (pps).

  • Pre-scrubbed traffic is Netflow data collected from Silverline's transit providers as traffic first enters the Silverline infrastructure.
  • Post-scrubbed traffic is Netflow data collected from Silverline's infrastructure as it sends clean traffic to customers via GRE tunnels, the Proxy Infrastructure, L2VPNs, or other means.

DDoS_Dashboard.jpeg

 

Environment

  • Silverline DDoS
  • Portal
    • DDoS Dashboard
    • Network Traffic

 

Procedure

Portal Navigation

The DDoS Dashboard is available in 2 places on the Portal

  • Dashboards > DDoS Dashboard
  • Monitor & Analyze > Network Traffic

DDoS_Dashboard.png

 

Graphs

The DDoS Dashboard has these graphs:

Dashboard_tabs.png

  • F5 Silverline(default): Shows all of your traffic flowing through Silverline's infrastructure.
  • Application: Visualizes Netflow data based on ports and protocols. For example, if the system collects TCP data to port 80, it assumes this is HTTP traffic. Note: This particular graph has no true Layer 7 visibility.
  • Zones: Pre- and post- scrubbed data network flow, separated out by Silverline zones (US East, US West, EU, APAC).
    • To switch between pre- and post-scrubbed views, use the drop-down in the upper-right:
      • Zones_Drop-down.png
    • Pre-scrubbed traffic is Netflow data collected from Silverline's transit providers as traffic first enters the Silverline infrastructure.
    • Post-scrubbed traffic is Netflow data collected from Silverline's infrastructure delivering clean traffic to customers via GRE tunnels, the Proxy Infrastructure, L2VPNs, or other means.
    • Outgoing is related to proxy traffic, and is traffic that is coming back from the proxy to the client. 

 

Router Monitoring customers will also see:

  • Customer: If the "Customer" tab is visible, you have subscribed to Silverline's router monitoring service. Silverline will monitor Netflow from your local routers, alerting on anomalies derived from various trigger mechanisms, including profiled traffic, set thresholds, and known DDoS attack vectors. See: Router Monitoring: Network Traffic

 

Tables

Below the charts, you'll see several tabs. Each tab contains a table of data.

DDos_Dashboard_Tabs.png

  • Events: which are actions that occur within a set timeline, such as a DDoS attack, and the responses to that event. Events can include mitigation annotations, notes, PCAPs, and alerts.
  • Alerts: Alerts are triggered when a threshold is met or exceeded by a sampling rate detected on our mitigation devices. For more info, see How do DDoS alerts trigger?.
  • Mitigations: See what mitigation measures were enacted, and corresponding bandwidth levels of dropped traffic.
  • Top Talkers: IPs generating the most traffic
  • Reports:  Reports are preconfigured, automated PDF reports. All DDoS Customers get a daily report. If you want additional reports (weekly, bi-weekly, monthly, etc), contact the SOC.

 

Additional FAQs

Question Answer
How is the graph data displayed in the timeline gathered? Traffic as seen via the timeline graph is derived from sampled Netflow data.
What is the Netflow sampling rate leveraged by Silverline? The sampling rate is 1/1000.
I noticed a spike in my proxy graphs, but didn't see a corresponding spike in the timeline. Why is this? Proxy graphs are counter based, where the Timeline graph is Netflow based. Due to the nature of sampled Netflow, and the 5 minute calculation, small spikes may not display via the timeline.
My Proxy graphs don't add up to my Timeline graph. Why?

Proxy graphs display individual proxy stats, where the Timeline graph is a total traffic view.

Can I view smaller subnets, or individual IP stats, in the Timeline graph?

YES! Just inform support@f5silverline.com what subnets you want to monitor, and after a brief set-up period the graphs will be available via the Timeline.

 

Related Content

Was this article helpful?
2 out of 2 found this helpful
Have more questions? Submit a request