Resolving blocked traffic

Lumen Defender℠ Powered by Black Lotus Labs® blocks traffic based on threat level and IP address. Defender Essentials blocks traffic on Lumen provider edge (PE) using an ingress filter, while Defender Plus blocks traffic on several locations in the Lumen network using an egress filter.

Use the information below to determine if traffic to or from an IP address is being blocked, potentially by Defender. 

  • Use IP Address Lookup to check if Defender is blocking the IP address. 

    If Defender is blocking the address, you will see information about the risk it poses.

    If you don't get any results, Defender isn't blocking the address, but it may be blocked elsewhere. 
  • Ping the IP address using the command prompt (ping X.X.X.X).

    If you don't get a response, try pinging a known IP address (e.g., 8.8.8.8) first to ensure traffic is allowed through any filters on your network. 

    If ping still doesn't work from your location, go to https://ping.pe and ping the IP address there. If this ping works, filtering may be occurring. However, you'll want to investigate further. 
  • Use traceroute to investigate the traffic path and find where traffic stops. Traceroute identifies where responses occur in the device chain between you and the remote IP. 

    Defender Essentials drops traffic on the link between the Lumen PE router and your terminating customer edge (CE) device. Drops anywhere else indicate filtering is likely happening on that device or the device doesn't have a return route. 

    Defender Plus allows the traffic to get to a blocked IP address, but drops it at a Defender server on the way back to your device. Drops that happen elsewhere indicate filtering is likely happening on that device or the device doesn't have a return route. 

Note: Defender Essentials doesn't affect latency. Defender Plus can cause minimal latency on inbound traffic because it shifts traffic to the nearest Defender server. Use ping and traceroute to determine latency.