What is monitored on the Bot/DDoS Live Stats screen?

Short answer

The Live Stats tab of a vService with Bot/DDoS protection enabled shows the current state with per-second rates; it does not store data and no time range is selected. The sections are Frontend, L7 DDoS & Threat Protection (the Stopped, Monitored, Whitelisted and Clean aggregator cards, the Bot, IP Reputation and L7 DDoS cards, and the action cards), Bot Score Classes, Distribution (the Triggered Factors, IP Reputation Category and DDoS Rule tables), Captcha, Quarantine and Waiting Room depending on the configuration, Source IP Statistics and Live Traffic. The refresh interval is 1, 5, 10 or 30 seconds (default 1 second); the stream stops after about 30 minutes and is restarted with the LIVE indicator. In a cluster, each device is shown in a separate column, and the values are not totaled.

Sections

The screen is opened through the Left Monitor Panel → Bot/DDoS Protected vServices → vService → Live Stats path; the tab is displayed to users who have monitoring permission in the Load Balancer area (accessing Live Stats). The LIVE indicator at the top left stops and restarts the stream; the 1s, 5s, 10s, 30s chips next to it select the refresh interval.

Frontend

These are instantaneous cards that belong to the vService's own traffic engine and frontend; they do not show the device as a whole: Uptime, CPU, Memory Usage, Current Sessions, Queued Requests, HTTP Request/s (Rate Max on L7 TCP), New Connection/s, Throughput, Incoming and Outgoing. On a vService that terminates TLS, SSL TPS and SSL Connections are also present, and on an HTTP vService, Avg. Response Time. The percentage badge at the top right of some cards is the ratio of the value to the limit of the related L7 DDoS block; whether the block is working is read from the mode (Off / Monitor / Active) in the badge's tooltip.

L7 DDoS & Threat Protection

Gives the per-second distribution of the decisions of the three protections with three card groups (section):

Group	Cards	What does it show?
Aggregator cards	Stopped, Monitored, Whitelisted, Clean	Each request is counted in only one of them: requests that undergo enforcement, requests that would undergo enforcement in Monitor mode, requests let through because of an exemption or a verified bot, and requests that enter none of these
Protection cards	Bot, IP Reputation, L7 DDoS	Which protection gave the decision; each card counts the enforcements and the Monitor stamps of that protection together
Action cards	Silent Drop, Blocked, Tarpit, Redirected, Show Content, CAPTCHA, Quarantined, Bandwidth Limited	The type of the action applied

Bot Score Classes

The per-second distribution of the calculated bot scores into four bands: Clean (0–39), Suspicious (40–59), Bot (60–84) and Bad Bot (85–100). The cards count requests, and each request falls into a single band (score bands).

Distribution

Three tables show what is triggered with the Requests/sec and Share columns; rows not triggered at that moment stay in the list with a value of zero:

Table	What does it list?	When is it seen?
Triggered Factors	The detection factors that produce the bot score	While Bot Protection is Active or Monitor
IP Reputation Category	The reputation categories in which the address is recorded	While IP Reputation Protection is Active or Monitor
DDoS Rule	The triggered L7 DDoS limit block (Source IP Request Rate, Source IP Connection Rate, Source IP Error Rate, Total Request Rate, Total Connection Rate, Active Source Count, country and network type rules, hard ceilings)	Only while L7 DDoS Protection is Active

While L7 DDoS Protection is in Monitor mode, which limit would be triggered is read not from this screen but from the Would… rows in Event Logs.

Captcha, Quarantine and Waiting Room

These sections are seen only when the related configuration exists. The Quarantine section contains the Quarantined (the number of records in the penalty box at that moment) and New entries cards; New entries counts not the actors newly entering the box but the requests per second coming from the actors in the box. The penalty box is set up when a protection that sends to the box is in Active mode. The Captcha section shows the challenges shown, solved and failed, and the Waiting Room section (HTTP only) shows the visitors inside and in the queue.

Source IP Statistics

Gives how the load is distributed among the source addresses with raw counts in a fixed ten-second window: Active IPs, Peak Req/IP (10s), P95 Req/IP (10s), Peak Err/IP (10s), Peak Conn/IP (10s), P95 Conn/IP (10s), Peak In/IP (10s) and Peak Out/IP (10s). On an L7 TCP vService, the request and error cards are not present. If the peak value is high but the P95 value is low, a single address is producing the load; if the two are close to each other, the load is spread across the base. The P95 values are estimates.

Live Traffic

The map shows the distribution of all the traffic coming to the vService by country (Country HTTP Request/s on HTTP, Country Connection/s on L7 TCP); it is not an attack map. The table below it lists at most twenty source addresses producing the most load at that moment, with the Source IP, Req (10s), Conn (10s), Err (10s), In (10s) and Out (10s) columns.

Points to Watch When Reading

• The four aggregator cards are a disjoint partition; the protection cards, on the other hand, overlap: if two protections object to the same request, the cards of both increase, so the three protection cards are not totaled.
• Stopped is the total of the seven action cards other than Bandwidth Limited; since bandwidth limiting does not terminate the request, it does not enter this total.
• Triggered Factors counts factor triggerings; since a single request can trigger more than one factor, the total of the rows can exceed the number of requests. Bot Score Classes, on the other hand, counts requests.
• The 30-second interval does not enlarge the values; it only changes the refresh frequency. When the interval is changed, the stream is re-established and the rates are read as zero once.
• When a read cannot be made, some cards show - and some show 0; in a section that constantly reads zero, the traffic is verified with Event Logs (scope and limits).

Scope and Limits

• Data is not stored; the history and the trend are monitored on the Dashboard tab.
• There is no rule- or host-based breakdown; another screen cannot be passed to from the cards and tables. Examination at the rule level is done with Event Logs.
• In a cluster setup, each device shows only the traffic passing over itself in its own column; if the peer device cannot be reached, the cards in that column read - or 0.
• Each refresh makes separate reads from the traffic engine; on a busy vService, a 5- or 10-second interval is preferred.
• Live Stats on the LB side: What does the Live Stats screen show?

Common Misconceptions

• "Live Stats keeps updating as long as it stays open." The stream stops after about 30 minutes; it is restarted by turning the LIVE indicator off and on or by refreshing the page.
• "The countries on the map are attack sources." The map shows all the traffic; the attack breakdown is read from Dashboard and Event Logs.
• "The block of a card with a percentage badge is working." The badge is also calculated over the default limit on a block that is off; the status of the block is read from the mode in the tooltip.
• "New entries counts the new actors entering the box." The card counts the requests coming from the actors in the box; entries into the box are monitored from the → Quarantined suffix in Event Logs.

How it is done in the documentation

• Live Stats · Screen Controls
• Live Stats · L7 DDoS & Threat Protection
• Live Stats · Distribution
• Live Stats · Source IP Statistics
• Live Stats · Scope and Limits

Related questions

• What is monitored for the WAF on the Live Stats screen?
• What does the Live Stats screen show?
• What is a bot score; what do the Clean, Suspicious, Bot and Bad Bot classes mean?
• Can I see the Bot/DDoS events of all vServices on one screen (Global Event Log)?