> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/product-guides/netflow-ddos-detector/interface/traffic-anomalies.md).

# Traffic Anomalies

Netflow DDoS Detector is used for in-depth analysis of traffic, to detect DDoS-related anomalies. 

{% hint style="info" %}
DDoS attacks (defined as anything that reaches a limit, with DDoS being determined as the reason) always get displayed as anomalies. However, not all anomalies are DDoS attacks; sometimes the traffic just exceeds normal traffic profiles.
{% endhint %}

## Anomaly reporting

The *Traffic Anomalies* feature logs each individual minute in which traffic anomalies are detected. For every entry, it shows:

* **Date**: The exact time and date the anomaly was recorded
* **Prefix**: The network prefix that received the anomaly
* **Reroute**: Whether the traffic was rerouted due to the anomaly
* **Message**: A description of the anomaly. Generally, this includes the condition that triggered it (e.g., “1000 Mbps exceeded”) along with real-time traffic values, or a note that detection ended (e.g., “over after 1” indicates the anomaly ended after one minute).

### Message structure

Here is an example of a Message value:

```
 minute 1 (1000 mbps exceeded, mbps:1150, kpps:116, nprefixes:265)
```

* **minute 1**: Indicates the first minute in which the anomaly was detected. If the condition persists across multiple minutes, you’ll see multiple sequential entries with similar criteria.
* **1000 mbps exceeded**: Describes the specific rule that triggered the anomaly—here, traffic throughput exceeded 1000 Mbps.
* **mbps:1150, kpps:116, nprefixes:265**: These are the measured values at the time of the anomaly.
  * **Mbps**: Megabits per second (throughput)
  * **Kpps**: Thousands of packets per second
  * **Nprefixes**: Number of unique source IPs sending traffic

Multiple anomaly conditions (1000mbps exceeded, 200 isps exceeded, 500 nprefixes with small packet size, etc) can be active simultaneously.

***

## How anomalies are detected

The anomaly detection system operates on predefined thresholds. Here’s a breakdown:

1. **Threshold Monitoring**: Traffic metrics (Mbps, Kpps) are continuously monitored for each network prefix.
2. **Triggering Conditions**: If any of these metrics exceeds its configured threshold (e.g., >1000 Mbps), the system flags it as an anomaly.
3. **Logging**: Once triggered, an entry is created showing:
   * The exact minute the anomaly was detected
   * The metric(s) that exceeded the threshold
   * The actual measured values
4. **Persistence**: If the anomaly condition continues in the next minute, a new entry is logged with updated values, keeping the anomaly active.
5. **Resolution**: When the traffic returns to normal (below thresholds), a message like “over after 1” indicates the anomaly is resolved and how long it lasted.

## Traffic Anomalies interface

<figure><img src="/files/CKAJCEsJjLfKTmnxOeqS" alt=""><figcaption></figcaption></figure>

Clicking on Details opens the Flow View of an instance. To see the reported anomaly, clicking through the target IPs is necessary.

<figure><img src="/files/juEQDxQkLG9QbCZUiXF7" alt=""><figcaption></figcaption></figure>

After clicking through to the chosen traffic anomaly, the following information is displayed

<figure><img src="/files/Fh8G6Um8Nx86Q2pFBwBG" alt=""><figcaption></figcaption></figure>

| Name        | Possible Values  | Explanation                                                                                                         |
| ----------- | ---------------- | ------------------------------------------------------------------------------------------------------------------- |
| Date        | 11.08.2022 07:54 | Date and Time of Anomaly (down to the millisecond)                                                                  |
| Target IP   | 168.0.0.1        | Targeted IP                                                                                                         |
| Target Port | 2048             | Port of Targeted IP                                                                                                 |
| Source IP   | 168.0.0.1        | Source IP                                                                                                           |
| Source Port | 2048             | <p>Source Port</p><p><em>Port 0 will be used for protocols that don’t have source ports (ICMP for example)</em></p> |
| Protocol    | ICMP,UDP,TCP     | Which protocol was used to receive data                                                                             |
| Size        | 30GB             | size of data sent                                                                                                   |
| Packets     | 67.108.864       | number of packets received                                                                                          |