Active Connections
See every connection on your server as it happens: who is connecting to your services, where your processes connect out to, and which IPs need attention.
Overview
Open DDoS Protection > Active Connections. The page is built from a live socket snapshot of the server and refreshes on its own. From top to bottom it shows:
- Summary tiles: Incoming connections (from N remote IPs), Outgoing connections (by N processes), Remote IPs (in N subnets) and Alerts. Each tile shows the change since the last refresh, and Incoming and Outgoing include a small trend line. Click Incoming or Outgoing to filter the map. Click Remote IPs or Alerts to jump to the table or the alerts list.
- Connection map: an animated network map of the server.
- Alerts and Live activity cards.
- All connections table.
Connection Map
Your server sits at the centre. Incoming services (listening ports such as :443 httpd or :22 sshd) are arranged on one side and outbound processes (for example php-worker or mail-fetch) on the other. Remote IPs, with country flags, sit on the outer ring. The number in each node is its connection count. Moving dots on each link show traffic direction.
- Direction: All, Incoming or Outgoing.
- State: All states, Established or Half-open (SYN). Half-open is useful for spotting SYN floods.
- Top 10 / Top 15 / Top 25: how many of the busiest remote IPs get their own node. Quieter IPs are folded into subnet groups and +N nodes, so the map stays readable with thousands of connections.
- Search: filter by IP, port, process or user. The search filters both the map and the table.
- Zoom and pan: use the + and − buttons or the mouse wheel, drag the background to pan, and drag nodes to rearrange them. Fit to view resets the layout.
- Live / Paused: the map updates every few seconds. Click Live to freeze it while you investigate. The label shows when it was last updated.
- Full screen: expand the map to fill the screen.
Your filter choices are remembered in the browser.
Legend
| Item | Meaning |
|---|---|
| Incoming service | A local listening port that remote IPs connect to. |
| Outbound process | A local process that opens connections to remote hosts. |
| Remote IP / In + out | A remote address. In + out means it both connects in and is connected to. |
| Subnet group | Several quieter IPs from the same /24 (IPv4) or /64 (IPv6). |
| Allowlisted | The IP is on the allow list. |
| Near DDoS limit | The IP is at 70% or more of its per-IP or per-port DDoS connection limit. |
| Suspicious | A process is connecting out to a port in DDOS_SUSPECT_PORTS (SMTP, IRC and common crypto-mining pool ports). |
| Blocked | The IP is denied or banned but still has open connections. |
Status is shown with both colour and shape. Click a legend item to highlight matching nodes, and click it again (or press Esc) to clear.
IP Details Drawer
Click any remote IP on the map or in the table to open its details. The drawer shows the country and reverse DNS, status badges, and total, incoming and outgoing counts. It also shows a DDoS limit gauge with the 70% warning mark, and which of your services and processes the IP talks to. The Connections tab lists every flow for the IP.
- Block IP adds the IP to the deny list (all ports).
- Allow IP adds it to the allow list and lifts any deny or ban.
Clicking a service, process, subnet group or +N node instead opens a list of its IPs. The list has a filter box and checkboxes, and buttons to Block selected or Block subnet in one go.
Alerts and Live Activity
SecLayer raises an alert, most severe first, for:
- IPs near the DDoS limit;
- IPs with 10 or more half-open (SYN) connections;
- IPs that are blocked but still connected;
- processes connecting out to a mining, spam or IRC port.
Click an alert to open the IP. Live activity lists connections as they open and close.
The suspicious port list is the DDOS_SUSPECT_PORTS setting in seclayer.conf. The default is 25,465,587,6667,6697,3333,4444,5555,7777,14444, and ranges such as 3333:3340 are allowed.
All Connections Table
Every flow grouped by remote IP, direction, port and process, busiest first. It shows the remote IP with a status dot, the direction, local port, process and user, TCP states and the connection count. Use Block to deny an IP or the eye icon to open its details. Use Entries Per Page to page through long lists. The table refreshes every 15 seconds, but pauses while your mouse is over it.
Dashboard Widget
A compact version of the map with the 10 busiest IPs is shown on the Dashboard as Live connections. Click a node there to open it on this page.