Security class

How to view detailed information about attack protection?

After adding the protected public IPs to a TBSP instance, monitor the total ingress bandwidth, back-to-origin bandwidth, attack bandwidth, total ingress packet rate, back-to-origin packet rate, attack packet rate, and DDoS attack logs on the monitoring and attack records pages.

To view the monitor information of a protected IP, follow the detailed steps as follows:

1. Log in to the Management Console and navigate to Product Services - Networking - EIP.
2. Navigate to TBSP in the left-hand menu to view the TBSP list.
3. Click the instance name to open the Instance Details page.
4. Click Monitor in the left navigation menu to reach the Monitor page and review monitoring information for the protected IP.

Users can also manage TBSP alarm strategies. On the Monitor page, click Alarm Details to access the Alarm Configuration page. For detailed steps, refer to BCM Alarm Management.

How to scale up the capacity of a TBSP?

The steps to scale up the capacity of a TBSP are as follows:

1. Log in to the Management Console and navigate to Product Services - Networking - EIP.
2. In the left navigation bar, select TBSP to access the TBSP list.
3. Click Capacity Scaling Up on an existing instance to open the Configuration Change page.

4. Select the desired IP capacity for the service package. The scale-up configuration will take effect immediately upon payment completion.

   Note: TBSP capacity supports only scaling up, not scaling down.

Is DDoS basic protection free of charge?

Baidu AI Cloud provides EIP with free basic DDoS protection of up to 5Gbps. For higher levels of protection, users can choose TBSP according to their needs to respond quickly to attacks.

What types of protection are available?

Protection against the following network-layer attacks:

• SYN flood attacks;
• ACK flood attacks;
• FIN/RST flood attacks;
• UDP flood attacks;
• ICMP flood；
• TCP connection exhaustion attacks, etc.; Application-layer attacks:
• Effectively mitigate HTTP GET/POST flood attacks;
• CC attacks;
• HTTP slow header/post attacks, among others.

What should I do if the basic protection threshold is too low to satisfy demands?

Purchase the TBSP service for hundreds of Gbps-level defense capabilities without changing the existing IP. For Tbps-level DDoS protection thresholds, users can choose the advanced DDoS protection service and redirect traffic to the advanced protection IP.

Why are blocking policies necessary? Why can't Baidu AI Cloud provide unlimited free DDoS protection for users?

Baidu AI Cloud lowers user cloud costs by sharing infrastructure, where all users utilize the public network egress of Baidu AI Cloud. However, during large-scale DDoS attacks, not only the targeted object but also the entire Baidu AI Cloud network could be impacted. To prevent DDoS attacks from affecting other uninvolved users and to ensure the overall stability of the cloud platform network, blocking becomes necessary.

DDoS protection entails significant costs, primarily stemming from bandwidth expenses. The bandwidth is procured by Baidu AI Cloud from telecom providers like China Telecom, China Unicom, and China Mobile. When calculating bandwidth fees, these operators do not exclude DDoS attack traffic, instead charging Baidu AI Cloud for the total bandwidth consumed. Baidu AI Cloud offers basic DDoS protection to defend cloud platform users against attacks free of charge while managing costs. However, if attack traffic exceeds the threshold, Baidu AI Cloud will block traffic from the attacked IP to avoid additional fees.

If an IP is blocked because attack traffic surpasses the threshold, users can purchase the TBSP service to raise the DDoS protection threshold to the 100Gbps level without needing to change their existing IP. For Tbps-level DDoS protection thresholds, users can opt for the DDoS advanced defense service. After binding the protection IP, users should submit a ticket requesting staff to unblock the attacked EIP. Services can then be accessed via the protection address, while the EIP will require 24 hours to exit the blackhole state.

What should I do if my EIP is blocked?

Blocking may occur due to various reasons, such as an EIP being subjected to DDoS attacks, security vulnerabilities in the associated cloud host, or non-compliant activities on the instance.

If DDoS attacks exceed the capacity of Baidu AI Cloud's Cleaning Center, Baidu AI Cloud reserves the right to throttle traffic to maintain public network stability. Instances protected by the affected IP may experience bandwidth limitations or even outright blocking. Blocked IPs can be manually released via the release center or will automatically be unblocked by the system after 24 hours.