> For the complete documentation index, see [llms.txt](https://docs.link11.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.link11.com/using-link11/api/network-ddos.md).

# Network DDoS

{% hint style="info" %}
The information below assumes you have already the [Introduction to the Link11 API](/using-link11/api/introduction.md).
{% endhint %}

## Service Key definition

`apikey=infraddos`

## Domain Key definition <a href="#id-customerapi-webddos-webddoscommands" id="id-customerapi-webddos-webddoscommands"></a>

For the commands that include a Domain Key (referred to below as $DOMAINKEY), use the [API Key for the instance from WebGUI](broken://pages/VUDuLHzvFgR0480bepBo).

***

## API commands <a href="#id-customerapi-infrastructureddos-infrastructureddosapicommands" id="id-customerapi-infrastructureddos-infrastructureddosapicommands"></a>

### **Get Statistics**

`https://api.link11.de/?apikey=infraddos&domainkey=[$DOMAINKEY]&get_stats&from=1633076968&to=1633150568&aggregate=86400&type=clientbytes`

| Parameter | Description                                                                                                                                                                                                                                                                                                                                               |
| --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| from      | Unix timestamp in UTC determining the start time/date of the query                                                                                                                                                                                                                                                                                        |
| to        | Unix timestamp in UTC determining the end time/date of the query                                                                                                                                                                                                                                                                                          |
| aggregate | The "bucket" size for the returned records in seconds. Example: To return data in one-hour buckets, set the value to 3600 (seconds in an hour).                                                                                                                                                                                                           |
| type      | <p><code>clientbytes</code></p><ul><li>returns statistics between the requestor (client) and the Link11 proxies</li></ul><p><code>serverbytes</code></p><ul><li>returns statistics between the Link11 proxies and the customer origin</li></ul><p><code>total</code></p><ul><li>returns the combined statistics for clientbytes and serverbytes</li></ul> |

**Response:**

```
{
    "results":  2,
    "type":  "clientbytes",
    "time_to":  "2021-10-02 04:56:08",
    "time_from":  "2021-10-01 08:29:28",
    "data":  [
                 {
                     "value":  30720,
                     "date":  "2021-10-01 00:00:00"
                 },
                 {
                     "value":  2048,
                     "date":  "2021-10-02 00:00:00"
                 }
             ]
}
```

### **Enable Attack Mode**

This endpoint will enable attack mode on the given IP address.

`https://api.link11.de/?apikey=infraddos&domainkey=[$DOMAINKEY]&trigger_attack_mode&ip=<IP>`

| Variable              | Example   | Explanation                                                                     |
| --------------------- | --------- | ------------------------------------------------------------------------------- |
| trigger\_attack\_mode |           | Action this call will take (triggers attack mode for specified IP address)      |
| ip                    | 168.0.0.1 | An individual IP (not CIDR network/array) that attack mode should be enabled on |

**Response:**

```
{
"return_code":200,
"return_text":"OK"
}
```

**Possible Error Codes**

<table><thead><tr><th>Entered URL</th><th width="229">Error</th><th>Meaning</th></tr></thead><tbody><tr><td><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_attack_mode&#x26;ip=test</code></td><td>{"return_code":404,"return_text":"Not a protected ip"}</td><td>As you can see in the entered URL, the text ‘test’ has been entered instead of an IP, which is not part of the protected IPs</td></tr><tr><td><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_attack_mode&#x26;ip=0.0.0.1</code></td><td>{"return_code":404,"return_text":"Not a protected ip"}</td><td>The IP ‘0.0.0.1’ has been entered which is not part of the protected IPs for this customer</td></tr></tbody></table>

### **Deactivate Attack Mode**

This endpoint will deactivate a currently active attack mode on the given IP address.

{% hint style="info" %}
This endpoint can be used to deactivate attack mode on IPs that have been put into attack mode by Link11s automated systems or by users manually enabling Attack Mode.
{% endhint %}

`https://api.link11.de/?apikey=infraddos&domainkey=$DOMAINKEY& deactivate_attack_mode&ip=ip`

| Parameter                | Example   | Explanation                                                                         |
| ------------------------ | --------- | ----------------------------------------------------------------------------------- |
| deactivate\_attack\_mode |           | Action this call will take (deactivates attack mode for specified IP address)       |
| ip                       | 168.0.0.1 | An individual IP (not CIDR network/array) that attack mode should be deactivated on |

**Response:**

```
{
"return_code":200,
"return_text":"OK"
}
```

**Possible Error Codes**

<table><thead><tr><th width="276">Entered URL</th><th>Error</th><th>Meaning</th></tr></thead><tbody><tr><td><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_attack_mode&#x26;ip=test</code></td><td>{"return_code":404,"return_text":"Not a protected ip"}</td><td>As you can see in the entered URL, the text ‘test’ has been entered instead of an IP which is not part of the protected IPs</td></tr><tr><td><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_attack_mode&#x26;ip=0.0.0.1</code></td><td>{"return_code":404,"return_text":"Not a protected ip"}</td><td>The IP ‘0.0.0.1’ has been entered which is not part of the protected IPs for this customer</td></tr></tbody></table>

### **Get Attacks**

This endpoint will list attacks for the given time period.

`https://api.link11.de/?apikey=infraddos&domainkey=$DOMAINKEY&list_ddosbgplayer34_attacks&time_from=time_to`

<table><thead><tr><th>Parameter</th><th width="165">Example</th><th>Explanation</th></tr></thead><tbody><tr><td>list_ddosbgplayer34_attacks</td><td></td><td>Action that will be taken (listing BGP DDoS attacks on layer 3 and 4)</td></tr><tr><td>time_from</td><td>unix timestamp</td><td><p>optional value;</p><p>default is 31 days</p></td></tr><tr><td>time_to</td><td>unix timestamp</td><td><p>optional value;</p><p>default is the current time</p></td></tr><tr><td>prefix</td><td></td><td><p>optional value prefix to search for.</p><p>default is entire registered protected network array</p></td></tr></tbody></table>

**Response:**

```
{
"return_text" : "Ok",
"data" : [
{
"prefix" : "1.2.3.4",
"ticketid" : "ddosttacklayer341234567890",
"date" : "2021-09-25 10:00:00",
"duration" : "1"
},
{
"duration" : "2",
"date" : "2021-09-25 11:00:00",
"ticketid" : "ddosttacklayer342345678901",
"prefix" : "2.3.4.5"
}, [...]
```

### **Get Attack Details**

This endpoint will list the details of a given attack, including the source IPs, source countries, source ports, source ASNs, etc.

`https://api.link11.de/?apikey=infraddos&domainkey=$DOMAINKEY&get_ddosbgplayer34_attack_detail&ticketid=<ticketid>`

| Parameter                           | Example                    | Explanation                                                                       |
| ----------------------------------- | -------------------------- | --------------------------------------------------------------------------------- |
| get\_ddosbgplayer34\_attack\_detail |                            | Action this call will take (getting attack details for DDoS BGP layer 3/4 attack) |
| ticketid                            | ddosttacklayer341234567890 | The Ticket ID provided from the Get Attacks API call                              |

**Response:**

```
{
"return_text" : "Ok",
"return_code" : 200,
"data" : {
"prefix" : "1.2.3.4",
"mbps" : 3595.26,
"numsrcprefixes" : "3724",
"kpps" : 365.58,
"incoming_clusters" : [
{
"name" : "ffm7",
"mbps" : 1623,
"kpps" : 1566
},
{
"kpps" : 784,
"mbps" : 241,
"name" : "lax1"
},
{
"mbps" : 71,
"kpps" : 225,
"name" : "lon2"
},
{
"name" : "ffm14",
"mbps" : 8,
"kpps" : 4
},
{
"mbps" : 2,
"kpps" : 1,
"name" : "ams1"
},
{
"kpps" : 1,
"mbps" : 1,
"name" : "sgp1"
}
],
"traffic_vs_time" : [
{
"ipprotocol" : "17",
"kpps" : 295,
"mbps" : 732,
"date" : "2021-10-26 06:56:00"
},
{
"ipprotocol" : "6",
"date" : "2021-10-26 06:56:00",
"mbps" : 415,
"kpps" : 1358
},
{
"ipprotocol" : "17",
"date" : "2021-10-26 06:57:00",
"mbps" : 1906,
"kpps" : 772
},
{
"date" : "2021-10-26 06:57:00",
"mbps" : 834,
"kpps" : 2731,
"ipprotocol" : "6"
},
{
"date" : "2021-10-26 06:57:00",
"mbps" : 1,
"kpps" : 1,
"ipprotocol" : "1"
}
],
"samples" : {
"ipprotocols" : {
"17" : 4344,
"1" : 30,
"6" : 1
},
"srcprefixes" : {
"0.188.38.0" : 1,
"0.74.90.0" : 1,
"0.45.40.0" : 1,
[...]
"0.96.170.0" : 1
},
"srcports" : {
"0" : 2543,
"53" : 1484,
"1900" : 28
},
"srcasns" : {
"AS34984 Tellcom Iletisim Hizmetleri A.s." : 18,
"AS34470 PortTelekom LLC" : 1,
"AS25086 MTS PJSC" : 1,
"AS43060 IPLUS LLC" : 1,
[...]
"AS137125 Netsat Communications Private Limited" : 1
},
"srccountries" : {
"United Kingdom" : 33,
"Burkina Faso" : 4,
"Indonesia" : 128,
"Jordan" : 1,
[...]
"Panama" : 4
}
},
"date" : "2021-08-30 02:33:00",
"ticketid" : "ddosttacklayer34140454771",
"duration" : "2"
}
}
```

**Possible Error Codes**

<table><thead><tr><th width="280">Entered URL</th><th>Error</th><th>Meaning</th></tr></thead><tbody><tr><td><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;get_dosbgplayer34_attack_detail&#x26;ticketid=ddosattacklayer34ticketthatdoesntexist</code></td><td>{"return_code":404,"return_text":"Ticket id not found"}</td><td>As you can see in the entered URL, the text ‘ddosattacklayer34ticketthatdoesntexist’ has been entered instead of an actual ticket ID.</td></tr></tbody></table>

### **Trigger Reroute**

This endpoint will reroute the /24 from a given IP address. Please be aware that attack mode is not automatically triggered. If you want the Link11 filters in direct defense, than please also call the Attack Mode Trigger for the specific IP address.

`https://api.link111.de/?apikey=infraddos&domainkey=$DOMAINKEY&trigger_reroute&ip=<ipv4>&bgp_session_uuid=<bgpsession_uuid>,<bgpsession_uuid>&auto_withdrawal=<timestamp>`<br>

| Parameter          | Example                              | Explanation                                                                                                                                                                                                                                                                            |
| ------------------ | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| trigger\_reroute   |                                      | Action this call will take (trigger rerouting for specified subnet)                                                                                                                                                                                                                    |
| ip                 | 168.0.0.1                            | An individual IP (not CIDR network/array). Note that  the /24 in which this IP is will always be announced.                                                                                                                                                                            |
| bgp\_session\_uuid | 6c068b4e-fb38-4f23-8a48-7cef0e870a0f | The BGP Session ID on which the announcement should be active. (This can be obtained in WebGUI by expanding an entry in the **Network DDoS / BGP Sessions** window.) Multiple Sessions can be separated with a comma. Can also be “all” if it should be announced on all BGP sessions. |
| auto\_withdrawal   | unix timestamp                       | Optional value. Defines the UTC date & time when the route should be removed.                                                                                                                                                                                                          |

**Response:**

```
{
"return_text" : "multi-status",
"return_code" : 207,
"data" : {
"bgp_name" : "BGP TEST 2",
"announced_prefix" : "168.0.0.1",
"status" : "success",
"auto_withdrawal" : "1705587600"
},
{
"bgp_name" : "BGP TEST 2",
"announced_prefix" : "168.0.0.1",
"status" : "conflict",
"message" : "bgp session already rerouted."
},
{
"bgp_uuid" : "6c068b4e-fb38-4f23-8a48-7cef0e870a0f",
"announced_prefix" : "168.0.0.1",
"status" : "error",
"message" : "bgp session not found."
},
{
"bgp_name" : "BGP TEST 2",
"bgp_uuid" : "6c068b4e-fb38-4f23-8a48-7cef0e870a0f",
"announced_prefix" : "168.0.0.1",
"status" : "info",
"message" : "ip not belong to bgp instance."
}
}
```

**Possible Error Codes**

<table><thead><tr><th width="290">Entered URL</th><th>Error</th><th>Meaning</th></tr></thead><tbody><tr><td><code>https://api.link111.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_reroute&#x26;ip=123&#x26;bgp_session_uuid=&#x3C;bgpsession_uuid>,&#x3C;bgpsession_uuid>&#x26;auto_withdrawal=&#x3C;timestamp></code></td><td>{"return_code":<code>401</code>,"return_text":"Invalid ip format: &#x3C;ip>"}</td><td>As you can see in the entered URL, the text ‘123’ has been entered instead of normal IPv4.</td></tr><tr><td><code>https://api.link111.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_reroute&#x26;ip=&#x3C;ipv4>&#x26;auto_withdrawal=&#x3C;timestamp></code></td><td>{"return_code":<code>402</code>,"return_text":"bgp_session_uuid param is not defined."}</td><td>As you can see, the bgp_session_uuid parameter is missing.</td></tr><tr><td><code>https://api.link111.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_reroute&#x26;ip=&#x3C;ipv4>&#x26;bgp_session_uuid=&#x3C;bgpsession_uuid>,&#x3C;bgpsession_uuid>&#x26;auto_withdrawal=xyz</code></td><td>{"return_code":<code>401</code>,"return_text":"Invalid auto_withdrawal format: &#x3C;auto_withdrawal>"}</td><td>As you can see in the entered URL, the text ‘xyz’ has been entered instead of a normal timestamp.</td></tr><tr><td><code>https://api.link111.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;trigger_reroute&#x26;ip=&#x3C;ipv4>&#x26;bgp_session_uuid=abc&#x26;auto_withdrawal=&#x3C;timestamp></code></td><td>{"return_code":<code>401</code>,"return_text":"Invalid uuid format: &#x3C;bgp_session_uuid>"}</td><td>As you can see in the entered URL, the text ‘abc’ has been entered instead of a correct bgp_session_uuid.</td></tr><tr><td><code>n/a</code></td><td>{"return_code":<code>404</code>,"return_text":"Defined ip is not belong to any bgp instance."}</td><td>If the URL is fine but the IP doesn't belong to any BGP instances, this error will be thrown.</td></tr></tbody></table>

### **IP Blocking**

| Parameter  | Example                | Explanation                                                                                                                              |
| ---------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| \[command] | block\_ip, unblock\_ip | The command that will be executed with this API call                                                                                     |
| dstip      | 31.214.212.5           | The protected “destination” IP that this API should be applied to.                                                                       |
| ip         | 50.34.106.211          | The client IP (source ip address) that should be blocked. Multiple IP addresses can be passed to this command as a comma separated list. |

**Possible Response Codes**

<table><thead><tr><th width="295">Entered URL</th><th>Response</th><th>Meaning</th></tr></thead><tbody><tr><td><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;ip=foo&#x26;dstip=foo</code><br><br><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;ip=foo&#x26;dstip=foo</code></td><td>400 Invalid IP</td><td>The “ip” value of “foo” is not a valid IP.</td></tr><tr><td><p><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;ip=31.31.31.31&#x26;dstip=foo</code><br></p><p><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;ip=31.31.31.31&#x26;dstip=foo</code></p></td><td>401 The format of the dstip parameter (foo) is invalid</td><td>The “dstip” value of “foo” is not a valid IP</td></tr><tr><td><p><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;dstip=31.214.212.5&#x26;ip=31.31.31.31</code></p><p><br><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;dstip=31.214.212.5&#x26;ip=31.31.31.31</code></p></td><td>200 Operation successful</td><td></td></tr><tr><td><p><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;dstip=31.214.212.5&#x26;ip=31.31.31.31,32.32.32.32</code><br></p><p><code>https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;dstip=31.214.212.5&#x26;ip=31.31.31.31,32.32.32.32</code></p></td><td>200 Operation successful</td><td></td></tr><tr><td><p><code>curl -s -X POST "https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;block_ip&#x26;dstip=31.214.212.5" -d "ip[]=31.31.31.31" -d "ip[]=32.32.32.32"</code><br></p><p><code>curl -s -X POST "https://api.link11.de/?apikey=infraddos&#x26;domainkey=$DOMAINKEY&#x26;unblock_ip&#x26;dstip=31.214.212.5" -d "ip[]=31.31.31.31" -d "ip[]=32.32.32.32"</code></p></td><td>200 Operation successful</td><td>This endpoint supports both GET and POST commands.</td></tr></tbody></table>