Top hitting IPs on my Google Compute engine instances

user_1244391 0
Viewed 74

Any Stackdriver monitoring metric available to identify the top hitting IP Addresses on my Google Compute engine instances or Google Load Balancer Service . Any other native GCP tool available which can help me to gather such reports.

This will help me to block any IP addresses sending malicious traffic

google-cloud-stackdriver google-cloud-platform ddos
2 Answers

Take a look at Cloud Armor for reporting and blocking malicious traffic.

You could enable firewall rule logging and create a logs-based metric for the rule(s) you're interested in, but this is only practical if you have a few IPs sending malicious traffic.
An example metric can be created with gcloud with a JSON config file such as:

{
  "name": "<myCustomMetric>",
  "filter": "logName:(projects/<projectID>/logs/compute.googleapis.com%2Ffirewall) AND jsonPayload.rule_details.reference:(\"network:<vpcName>/firewall:<firewallRule>\")\njsonPayload.disposition=\"ALLOWED\"",
  "labelExtractors": {
    "Source": "EXTRACT(jsonPayload.connection.src_ip)"
  },
  "metricDescriptor": {
    "labels": [
      {
        "key": "<sourceIP>"
      }
    ],
    "metricKind": "DELTA",
    "name": "projects/<projectID>/metricDescriptors/logging.googleapis.com/user/<myCustomMetric>",
    "type": "logging.googleapis.com/user/<myCustomMetric>",
    "unit": "1",
    "valueType": "INT64"
  },
}

Where :

  • <myCustomMetric> is the name you want for your metric
  • <projectID> is your project ID
  • <vpcName> is your VPC network name
  • <firewallRule> is you VPC firewall rule name
  • <sourceIP> is the label you want for the incoming IP address
user_167878080

You can use Cloud SDK with the command gcloud compute addresses list - list addresses to get that list, as the following Official GCP’s Documentation says. Examples:

$ gcloud compute addresses list --uri
$ gcloud compute addresses list --global
$ gcloud compute addresses list --filter=region:us-central1

A second option is to set up an Uptime Check following this url’s steps and then verify the List uptime-check server IP addresses, as the following enter link description here indicates. Here is an example of the code to create the Uptime Check:

public static object CreateUptimeCheck(string projectId, string hostName,
    string displayName)
{
    // Define a new config.
    var config = new UptimeCheckConfig()
    {
        DisplayName = displayName,
        MonitoredResource = new MonitoredResource()
        {
            Type = "uptime_url",
            Labels = { { "host", hostName } }
        },
        HttpCheck = new UptimeCheckConfig.Types.HttpCheck()
        {
            Path = "/",
            Port = 80,
        },
        Timeout = TimeSpan.FromSeconds(10).ToDuration(),
        Period = TimeSpan.FromMinutes(5).ToDuration()
    };
    // Create a client.
    var client = UptimeCheckServiceClient.Create();
    ProjectName projectName = new ProjectName(projectId);
    // Create the config.
    var newConfig = client.CreateUptimeCheckConfig(
        projectName,
        config,
        CallSettings.FromExpiration(
            Expiration.FromTimeout(
                TimeSpan.FromMinutes(2))));
    Console.WriteLine(newConfig.Name);
    return 0;
}

And the steps to list the IP addresses, once the Uptime Check is running:

In the Cloud Console, select Monitoring or click the following button. In the navigation pane, select Uptime checks. In the Uptime checks menu, click Download get_app. A file uptime-source-ips.txt is downloaded and contains the IP addresses.

There is no monitoring tool available right now inside of Cloud Monitoring yet.

user_169220440
Related