How to Read a Dstat Graph

The horizontal axis is time and the vertical axis is request volume. Our live charts plot a rolling 60-second window: the newest second enters on the right and the oldest drops off on the left, so the line always shows the last minute of traffic rather than the whole test.

Each point is the request count the target received in that second. The headline figure above the chart is the peak — the highest point in the current window — which is the number most people quote when they describe how hard a target was hit.

For a protected target the chart is split into series. Allowed traffic passed the protection legitimately, bypassed traffic defeated the protection and still reached the origin, and blocked traffic was stopped at the edge. The bypass series is the one that matters: it is the real measure of how much hostile load actually got through.

On an unprotected endpoint there is only one line — every request reaches the origin — which is why unprotected Dstats tend to show much higher origin-facing numbers than protected ones under the same attack.

A sharp spike followed by a flat line near zero usually means mitigation kicked in or the target dropped offline. A sustained plateau means the target is absorbing the load steadily. A staircase that keeps climbing means the load is still ramping and the target has not yet hit its ceiling.

Compare the incoming line against the bypass line: if incoming climbs while bypass stays flat, the protection is holding; if bypass climbs together with incoming, the protection is leaking.

A high peak alone does not mean a target failed — what matters is whether it kept responding. Likewise, a low bypass number during a short test is not proof of strength; protections can behave differently as an attack adapts. Always read the rolling trend, not a single frame.