For AI agents: the complete documentation index is available at https://docs.ovhcloud.com/en/llms.txt, the full documentation bundle is available at https://docs.ovhcloud.com/en/llms-full.txt, and this page is available as Markdown at https://docs.ovhcloud.com/en/guides/bare-metal-cloud/dedicated-servers/network-security-dashboard.md.
Skip to content
Appearance
Console(the OVHcloud Console, opens in a new tab)

Monitor DDoS attacks with the Anti-DDoS dashboard

View as Markdown

Monitor the DDoS attacks detected on your IP addresses in the Anti-DDoS dashboard, review their traffic and find out how to tune your protection

Objective

This guide explains the Anti-DDoS dashboard and gives an overview of the countermeasures triggered by the OVHcloud Anti-DDoS infrastructure when malicious network activity is detected. It also describes the additional protections you can implement to keep your services up and running. Traffic graphs are available for each IP address during detection events, to help you visualise the situation.

Requirements

Instructions

Network security

The OVHcloud Anti-DDoS infrastructure is a multi-layered, distributed defence system against cyberattacks. It consists of multiple edge locations and scrubbing centres that analyse incoming traffic and clean up malicious traffic. Together with the Edge Network Firewall and Anti-DDoS Game, it protects a wide range of services.

The Anti-DDoS infrastructure constantly analyses incoming traffic (detection) and, when needed, redirects it through our scrubbing centres located in data centres around the world (mitigation). The traffic is then analysed in depth, and malicious packets are filtered out before the traffic reaches your server or service.

For network-intensive workloads whose legitimate traffic can look like an attack, such as VPN servers, game servers or Solana nodes, you can apply a network traffic profile to your IP addresses. Profiling only refines how your traffic is analysed and mitigated: your services stay protected. For more information, see our guide on Anti-DDoS profiling.

What happens when an attack reaches my service's IP address?

Every time an attack is detected towards an IP address of your service, you are notified by email that its traffic has been rerouted through the Anti-DDoS infrastructure. You can also monitor these mitigation periods in more detail on the Anti-DDoS dashboard.

During the Beta, open the with the Discover the console >BETA_ button in the top-right corner. An ongoing attack is listed on the Anti-DDoS dashboard (Security > Anti-DDoS), and the Ongoing attacks counter of the targeted IP address is incremented. The DDoS Mitigation status of each IP address is shown on its own page: on the IP addresses page, click the IP address, then read the Network security section of its Overview tab.

Info

To find out how OVHcloud mitigates DDoS attacks, see our DDoS attack mitigation page.

Warning

The protection logic is based on the public IP addresses associated with a server or service. As a result, statistics and charts are calculated and displayed on a per-IP basis.

Anti-DDoS status of your IP addresses

During the Beta, open the with the Discover the console >BETA_ button in the top-right corner. The IP addresses page lists your public IP addresses, with the status of each one in the IP Alert, Edge Firewall and Game Firewall columns. The Anti-DDoS status of an IP address is shown on its own page.

  • To see the Anti-DDoS status of an IP address, click it in the list. On its Overview tab, the Network security section shows its DDoS Mitigation status, Automatic: the Anti-DDoS infrastructure automatically protects this IP address if an attack is detected.

    The same section shows the Anti-Spam and Anti-Hack status of the IP address, and an Anti-DDoS dashboard link to its traffic.

  • The Edge Firewall column shows the status of the Edge Network Firewall:

    • Enabled - The Edge Network Firewall is filtering incoming traffic to this IP address.
    • Disabled - Traffic only goes through the Edge Network Firewall when an attack is detected. The firewall is then activated automatically.

    To configure its rules, click the status in the column, or click the IP address and open its Edge Firewall tab.

  • The Game Firewall column (only for OVHcloud Game dedicated servers) can show:

    • Available - The Game Firewall is available but not configured yet. Configure your game rules so that they apply to this IP address.
    • Configured - The Game Firewall is configured for this IP address.
    • — - The Game Firewall is not available for this IP address, which means it is not configured on a supported product range.

    To configure it, click the IP address and open its Game Firewall tab.

  • The IP Alert column can show IP blocked (anti-hack) or IP blocked (anti-spam).

Anti-DDoS dashboard

During the Beta, open the with the Discover the console >BETA_ button in the top-right corner, then go to Security > Anti-DDoS. The Anti-DDoS dashboard lists the past and ongoing attacks on your IP addresses. You can filter the list by service, and by period (Day, Week, Month or Year).

The table contains the following columns:

  • Detection date - Timestamp of the first attack detection.
  • End date - Timestamp of when the scrubbing centre finished mitigating.
  • Destination IP - The IP address targeted by the attack.
  • Attack vectors - The types of attacks detected, such as UDP or TCP attacks.

The data retention period for the attack log is 1 year.

Warning

The source IP addresses of detected events are not displayed. They are usually spoofed (a DDoS attack can show sources other than the ones it really comes from), so this information would be misleading or unusable.

Click an attack in the list to open the targeted IP address. Its Overview tab summarises the attacks of the last 60 days: total, ongoing and mitigated attacks, and attacks by type. Its Traffic tab shows a graph of the traffic to your IP address during detection events, in bits per second (BPS) or packets per second (PPS). Outside these events, the tab is empty.

The graph shows the Legitimate traffic delivered to your IP address and the Filtered traffic dropped during attacks. Basic mitigation statistics are also displayed for the selected period, such as the number of events, the packets dropped, the bandwidth cleaned and the number of attacks detected.

The data retention period for traffic data is 60 days.

FAQ

Why are some attacks not shown on the Anti-DDoS dashboard?

Depending on the nature of an attack, different actions may be taken to best eliminate the threat. In both cases, attacks are mitigated as close to their origin as possible:

  • When an attack comes into the OVHcloud network (external), its traffic is redirected to the Anti-DDoS scrubbing centres for cleaning, and it is therefore visible on the dashboard.
  • Attacks originating from inside the OVHcloud network (internal) are handled by our security teams. Mitigation focuses on blocking the origin of the attack, and this mitigation is not reported by the Anti-DDoS infrastructure systems.

No attack is displayed on the Anti-DDoS dashboard. Is this normal?

Yes. It means that no suspected attack has targeted your public IP addresses during the selected period.

Why is no traffic graph or data shown for an IP address I enter?

This data is only available for public IP addresses during automatic detection events of the Anti-DDoS infrastructure, when traffic is redirected through a scrubbing centre.

Why is the traffic graph not available for some attacks on the Anti-DDoS dashboard?

Traffic data is only available for the past 60 days, while attacks can be reviewed for the past year.

An attack on my service is persisting. How can I better protect my server?

Some attacks may be so specific that the Anti-DDoS infrastructure cannot detect and clean them automatically. In such cases, the firewall configured on your server is your best option. We also recommend moving some of your server firewall rules to the edge of our network with the Edge Network Firewall. For more information on configuring its rules, see our Edge Network Firewall guide.

If attacks are not mitigated thoroughly enough, you can also make detection more aggressive for your IP addresses by applying a network traffic profile with a higher sensitivity. For more information, see our guide on Anti-DDoS profiling.

My service is under attack and I am experiencing problems on my server. What else can I do?

The Anti-DDoS infrastructure is designed to protect a wide range of services as efficiently as possible. In some specific cases, it may need additional tuning, for example to match the nature or the size of your application.

You can tune it yourself with Anti-DDoS profiling, currently in Beta: choose a network traffic profile and a sensitivity level adapted to your workload, and apply them to your IP addresses. For more information, see our guide on Anti-DDoS profiling.

If no profile matches your workload, or if the problem persists, visit our Help Centre and search for the appropriate action in the "network attack and/or Anti-DDoS related" category.

Provide OVHcloud with information

Whenever our Anti-DDoS system needs adjusting, you must provide us with the following details so that we can understand your case and help you:

  • Service hosted on the affected server
  • Date and time when the attack started
  • Date and time when the attack finished
  • Affected IP address(es)
  • Service, protocol and port used by the affected service
  • Size of the service (XS: 1-10, S: 10-100, M: 100-1k, L: 1-10k, XL: 10-100k, XXL: 100k+ connected clients)
  • Other services hosted on the server
  • Other ports used on the server
  • Are there other services on separate IP addresses: Yes/No
  • If yes, which IP addresses
  • Is legitimate traffic being dropped: Yes/No
  • Was the connection to the server lost: Yes/No
  • Which type of legitimate traffic is being dropped
Info

In some cases, we may ask you for an additional traffic capture.

To create this capture, run the following command on Linux:

tcpdump -w capture-ovh -c 100000 port not ssh

If you are using Windows, use Wireshark and capture 100,000 packets.

You can either attach the file to your support ticket or upload it to our file-sharing solution by following our guide Sharing files with the Plik tool, then share the link to the uploaded file in your support ticket.

Go further

Fine-tune Anti-DDoS protection with profiling

Enabling and configuring the Edge Network Firewall

How to protect a Game server with the application firewall

Join our community of users.

Was this page helpful?