Skip to main content
Version: 10.0

Understanding Victim Reports

Victim reports are generated based on historical or ongoing attacks detected against an address.  The report will include data from the zone that contains the victim before the attack start, and additional time after the attack ends (for context) if a historical attack.

If a victim is ongoing (still under attack) the victim report will adjust its end to five minutes prior to the time you request the report to ensure data has been collated accurately. Running reports on a victim immediately (or within the first five minutes) are not advised as a result.

Report Header​

The header will include your customized logo and report name. It will also contain the name of the zone the victim is in, "Victim Report" to identify the report, and the start and end times used for the data in the report. Depending on the attack length and whether or not it is ongoing, these times will be adjusted automatically to include some contextual data for the zone, or in the case of the end time, shortened to ensure data is collated properly for an ongoing attack. The start and end times, and all other timestamps used in the report, will be displayed in the timezone selected for rWeb.

Victim Details​

The first section will list all the basic information about the victim and the detected attack:

  • Victim ID- This is the unique ID assigned to the victim. It can be used for further API calls.
  • Zone- The name of the zone containing the victim.
  • Victim IP- The IP address of the victim.
  • Start Time- The detected start time for the attack. 
  • End Time- The end time for the attack. If the attack has not ended, this will be ongoing.
  • Attack Type- The attack type of the attack.
  • Attack Subtypes- The numeric ID and description for each subtype detected in the attack. 
  • Attack Packets- The total number of detected attack packets.
  • Dropped Packets- The total number of attack packets that have been dropped. In cases where this number is less than attack packets, the control for this attack type may have been put in monitor mode (detect but do not drop attack traffic).
  • Attack Bits- The total number of detected attack bits.
  • Dropped Bits-The total number of attack bits that have been dropped. In cases where this number is less than attack bits, the control for this attack type may have been put in monitor mode (detect but do not drop attack traffic).

Network Traffic​

This section includes three different graphs of zone traffic during the attack. The first two graphs will be packet and bit based graphs of zone traffic, using the closest fit data source.

The packet and bit rate graphs show total traffic In to the zone, total Clean (non-attack traffic), the traffic passed Out from the zone, and the Attack Start and End times overlaid on the graph. If the attack is ongoing, Attack End will be omitted.

The protocol graph will show the total mix of traffic in the zone, by TCP, UDP, ICMP, and Other.

Sample Packets​

In some cases, the filter devices will capture sample packets of the attack. Any captures made will be listed with the following information:

  • Source Address- The source IP address of the sample.
  • Timestamp- The timestamp for when the sample was captured.
  • DDoS Subtype- The numerical value of the attack subtype for the sample.
  • Subtype Description- The textual description of the attack subtype.
  • ASN- The Autonomous System Number (ASN) of the captured sample. This, and the remaining entries, require AS/CC information to be loaded in rWeb.
  • ASN Description- The text description of the ASN.
  • CC- The Country Code (CC) two letter abbreviation of the captured sample.
  • CC Description- The text description of the CC.

Filter Entries​

For filter list attack types, the filter list will be searched for IPs that were prevented from sending traffic to this victim. Each group of rows will show the following information:

  • Source Address- The source IP address of the filtered attacker.
  • Start Time- The timestamp for when the attacker was placed on the filter list.
  • End Time- The timestamp for when the filter list entry expired. This is usually a set duration after the Start Time based on the relevant attack type's configuration.
  • DDoS Subtype- The numerical value of the attack subtype for the filter list entry.
  • Subtype Description- The textual description of the attack subtype.
  • ASN- The Autonomous System Number (ASN) of the Source Address. This, and the remaining entries, require AS/CC information to be loaded in rWeb.
  • ASN Description- The text description of the ASN.
  • CC- The Country Code (CC) two letter abbreviation of the Source Address.
  • CC Description- The text description of the CC.