Open bans or live connections
Open your service's Configuration → Filtering, select the protected IP, then choose Bans or Flow Viewer. The dashboard calls this filtering Layer 3–5; this guide uses Layer 4.
Flow Viewer shows tracked TCP connections and UDP sessions forwarded to the selected protected IP. It is a live troubleshooting view, not a complete traffic history or a list of attacks. We do not retain or store flow information for long-term analysis and cannot answer questions about past flows.
Choose the right action
| Action | Use it to | Scope |
|---|---|---|
| Ban source IP | Temporarily block a client address. | That source IP accessing the selected protected IP in the regions you choose, across ports and connections. A shared client IP can represent several users, so banning it can affect them all. |
| Kill flow | Remove one tracked connection or session. | The exact source address, source port, destination address, destination port, and protocol shown in the confirmation. It does not create a ban or prevent the client from reconnecting. |
For a continuing filtering policy, see Layer 4 Rules or Access Control. HTTP/HTTPS bans and verification are covered separately in Layer 7 Bans.
Find or remove a ban
On Bans, use Lookup By IP to enter one client IP address, then click Query. Lookup and removal work with individual addresses, not CIDRs.
| Column | Meaning |
|---|---|
| Source Address | The banned client's IP address. |
| Region | The network region where the ban applies. An address can have entries in several regions. |
| Reason | CUSTOMER BAN means a manually added ban. Other reasons identify the mitigation classification that produced the ban. |
| Created | The recorded creation time. |
| Expires | The currently recorded expiry time. Bans expire automatically, but the displayed time can change as network updates arrive; it is not a guaranteed countdown and is approximate. |
To unblock an address, choose Action → Remove Ban on its row. This removes that address's bans for the selected protected IP in the row's region. Check other regional rows if you need to unblock it everywhere. Removal does not whitelist the address: filtering rules and automatic mitigation can still block it again.
Recent bans can take 2–3 minutes to appear. Use the Layer 4 ban logs link on the Bans page for historical entries, and allow time for status updates before checking again.
Add a temporary ban
- Under Add Bans, enter IPv4 addresses or CIDR ranges in IP Addresses / CIDRs, one per line.
- Review Regions. All available regions are selected initially; keep only those where you want the bans to apply.
- Click Add, then check the list for the expected addresses and regions. You can use Lookup By IP to check individual addresses.
You can submit up to 256 unique addresses per request. The limit counts addresses, not the number of regional copies of each ban.
CIDRs expand to every address in the range, including network and broadcast addresses. A /24 uses all 256 addresses, a /31 contains two, and a /32 contains one.
IPv6 addresses, hostnames, malformed entries, and requests exceeding 256 addresses are rejected before any bans are sent. Correct the entries and submit again. After a successful submission, refer to Expires for the recorded expiry and allow for delayed status updates.
Read and filter live flows
In Flow Viewer, enter a Client IP (IPv4), choose TCP or UDP if needed, and optionally enter a Destination port. Click Apply filters. Limit controls how many results are requested at a time: 25–500, with 100 selected by default.
| Column | Meaning |
|---|---|
| Source / Destination | Each endpoint as address:port. |
| Protocol | TCP or UDP. |
| Backend | The configured handling mode and destination: HTTP, RP (reverse proxy), Encapsulated, or Routed. This label comes from your service configuration and may not identify the backend actually chosen for a load-balanced connection. |
| Region | The location of the network edge handling the flow, not the client's location. |
| Age | Normally the time since creation; the last-seen time is used if creation time is unavailable. |
| Transfer | Recorded byte and packet totals labelled In and Out. Hover over abbreviated values for exact totals. These are not bitrates or billing totals. |
Use Load more when available to append results. Refresh defaults to 30s, with Off, 10s, and 1m also available. Refresh replaces the loaded list, so set it to Off while inspecting several pages.
Understand missing or incomplete results
- Partial data: more results may be available, to continue scrolling use Load More
- Stale data: the displayed information may be out of date while the network refreshes.
- Collecting transfer data… or —: counters are unavailable, not necessarily zero. This can happen when traffic is too low to measure accurately through sampling.
- No matching flows: check your filters. An empty list does not establish that the service has no traffic.
- Flow data is unavailable: retrieval failed. Retry shortly and contact support if it persists. If Load more fails, previously loaded rows remain visible.
Example: act on a client's connection
Suppose you are investigating client 198.51.100.44 connecting to TCP port 443 on your protected IP.
- In Flow Viewer, set Client IP to
198.51.100.44, Protocol to TCP, and Destination port to443, then click Apply filters. - Check the matching row's source, destination, and region before taking action.
- To temporarily block that client, choose Ban source IP. This opens Bans with the address filled in. Review the regions and explicitly click Add. Opening the form does not ban anyone; submitting it blocks that source IP across ports for the selected protected IP and regions.
- Alternatively, to remove just this tracked connection, choose Kill flow. Review both addresses, both ports, and the protocol in the confirmation dialog, then confirm Kill flow.
Flow killed successfully means the tracked flow was removed. Flow was already absent means it was no longer present when the action was processed; the delete request was still sent to the network. Recheck the list afterward. A client can reconnect unless a ban or filtering policy prevents it.
