service feature

Blackholing Insights – analyze dropped DDoS traffic

With Blackholing Insights, you get visual support when countering DDoS attacks while using Blackholing at DE-CIX. 

The tool shows you a variety of statistics and provides a peek into the traffic affected by the blackholing rules you have set. Traffic that is no longer visible to you – due to redirection (classical Blackholing) or filtering (Blackholing Advanced) – is visualized on the dashboard. Blackholing Insights is currently available at DE-CIX Dusseldorf, Frankfurt, Hamburg, Istanbul, Lisbon, Madrid, Marseille, Munich, and New York.

What you can analyze

The visualization is limited to the last four days of traffic going towards the prefixes with active Blackholing rules. These statistics can help you to understand where a DDoS attack is coming from, whether the attack is still ongoing or attack parameters have changed, and what traffic is affected by your Blackholing setup.

Blackholing Insights shows you:

  • The number of active rules for Blackholing and Blackholing Advanced
  • A table of traffic mapped to specific blackholing rules
  • Traffic in bits per second and packets per second over the course of time
  • The neighbor and origin autonomous systems the traffic towards your blackholed prefixes is coming from
  • The share of the traffic volume for the source and destination IPs in your blackholing traffic
  • The top source and destination ports
  • A heat map of the geographical distribution of the source of the traffic
  • The share of the traffic volume with respect to IP versions and protocols

Log in to see your stats

To take advantage of this free service, just log into the DE-CIX self-service portal to access your Blackholing Insights statistics. More information about what you can analyze can be also found in the portal in the Blackholing Insights documentation.