L3/4 DDoS Trends
Last update：2026-08-20 14:42:38
Reading time: About 3 minutes
The L3/4 DDoS Trends page displays data related to network-layer (L3/4) DDoS protection, helping you understand:
- The peak attack bandwidth and peak packet rate of network-layer DDoS attacks during the selected time range
- The overall DDoS attack trends and the distribution across different attack types
- A list of specific attack events, including each event’s status, duration, and attack type
Important: Because network-layer DDoS protection operates at the granularity of the scrubbing node IP rather than the hostname, network-layer DDoS protection report data for an Exclusive IP is generated only if you have purchased the Exclusive IP value-added service. This page is not enabled by default; if you have purchased an Exclusive IP, contact technical support to have it enabled.
Path: Analysis & Logs > L3/4 DDoS Trends
Metrics
Protection Data Summary
Shows the peak DDoS attack data for the selected time range:
| Metric | Description |
|---|---|
| Peak Attack Bandwidth | The maximum network-layer DDoS attack bandwidth (in Mbps) during the selected time range |
| Peak Attack Packet Rate | The maximum network-layer DDoS attack packet rate (in Mpps) during the selected time range |
DDoS Attack Trends
Shows how traffic changed over the selected time range. You can view it by either Bandwidth (bps) or Packet Rate (pps). The chart is divided into two sections:
The upper section shows overall traffic, including:
- Inbound Traffic: The raw traffic that reached the scrubbing node
- Mitigated Traffic: The attack traffic that was detected and mitigated
The lower section shows the distribution of attack traffic triggered by each type of network-layer DDoS security policy, including:
- SYN Flood
- ACK Flood
- UDP Flood
- ICMP Flood
- Other Flood
Attack Events
The attack event list shows details of network-layer DDoS attack events that occurred during the selected time range:
| Field | Description |
|---|---|
| Attack Event | When DDoS attack traffic is detected, an attack event begins; if no DDoS attack traffic is detected for 30 consecutive minutes, the event is considered ended. As a result, a single attack event may include multiple attacks. Click the event ID to view the details of each attack, including the target IP, attack time, attack type, and attack bandwidth |
| Status | Mitigating / Mitigated |
| Start Time | The time the DDoS attack was detected |
| End Time | The time the attack stopped |
| Duration | The total time from when the attack started to when it ended |
| Attack Type | The DDoS attack type for this attack event |
| Peak | The peak bandwidth for this attack event |
| Peak Time | The time the peak occurred |