User Guide
APconnections, Inc. // 303.997.1300 // www.netequalizer.com
Page 45 of 96
All rights reserved
Copyright © 2014, 2015 APconnections, Inc.
rev. 20150309
The DDoS Monitor displays all uninitiated requests coming into your network. You can see
how persistent the request is (Seconds) and how often it is hitting your network in the last
second (Rate), which then gives you an overall view (Count) of how active the attack is. For
example, in our table above, Index 5 has been running for 99 seconds, hitting the network
27 times per second, for a total of 2,756 hits.
By analyzing the values of Count, Rate, and Seconds, you can identify which external IP
addresses you want to block. In our example above, Index #1, #2, and #5 are candidates
to consider blocking.
All fields of the DDoS Monitor are defined in detail below.
DDoS Monitor Fields
Field
Definition
Expected Values
Index
Table row #
0, 1, 2, 3….
SRC IP
The source IP for this connection
External IP address
Suspect for a DDoS attack.
DST IP
The destination IP for this connection
Internal IP address
Port
Whether the traffic was initiated
internally or externally.
1 = inside initiated
2 = outside initiated
On the DDoS Monitor, this
should always be 2.
Seconds
How long the requests have been
running, in seconds.
Positive number greater than
zero.
Count
The number of times the request has
run over the Seconds indicated.
Positive number greater than
zero.
Rate
Number of requests per second
during the last second.
Positive number greater than
zero.
Blocked
Indicates if the SRC IP address has
been blocked using the DDoS FW.
yes = blocked
no = unblocked
Note: To keep this simple, Rate is just the
rate over the last second
. It is not an average over time.
Due to this, the Count field will not equal Rate x Seconds, and may not even approximate it,
depending on how variable Rate has been over time. However, the combination of Rate, Seconds, and
Count are a great indicator of whether an external IP is involved in a DDoS attack on your network.
