LayerOne Aegis

LayerOne Aegis helps you understand your VPS's network activity and review potential security issues. It brings together observed traffic, applications, open ports, vulnerability information where available, and DDoS activity in your client area.

Aegis is an optional customer security feature. You can disable its views and customer alerts in Settings. LayerOne's underlying security monitoring and included DDoS protection continue when you do so.

Open Aegis

After deploying an instance, sign in to your client area and select Aegis in the main navigation, or open Aegis directly.

• Dashboard: review inbound and outbound bandwidth, packet rates, traffic patterns, and the freshness of observations. Select a device to focus on one server, or use All devices for your account.
• Applications & ports: review your devices, their public IPs, observed open ports, identified services, and application traffic.
• Attack activity: review recorded DDoS incidents for your account.
• Alert preferences: choose how you receive DDoS notifications.
• Settings: enable or disable Aegis for your account.

Observations depend on available sensors and scan results. A newly deployed instance may appear before its first results arrive. Scanning concerns eligible public IPs; it does not provide an inventory of services inside a private network.

Allow the scanner IP to participate

If you want to participate in the vulnerability tracker, allow LayerOne's scanner IP address through the firewalls protecting your instance. The scanner needs to reach the services you want assessed. If a firewall or security tool blocks it, results may be incomplete or unavailable.

1. After deploying your instance, check Aegis for the scanner IP information associated with it.
2. Use the address explicitly identified as the scanner/source IP. The public IP listed for your instance is the scan destination, not the scanner address.
3. Add an inbound rule for that exact source address in your cloud firewall or attached Firewall Group, and in the firewall inside your VPS. Permit the TCP or UDP services you want assessed. For a single IPv4 source, use a /32 when a CIDR is required.
4. Check any additional security tools that might block the scanner, then review the next available scan results in Aegis.

Keep your firewall enabled and limit the exception to the confirmed scanner address. Allowing the scanner does not require opening the same services to everyone. Do not use an address copied from an example or an unrelated scan in your logs. LayerOne scanning can appear as connection attempts or port-scan events in your security logs; ask support if you need help identifying them.

How port scanning works

Port scanning checks which TCP and UDP ports respond on your instance's public IPs. A service probe may also identify the application, product, and version behind an open port. This helps you notice an unexpectedly exposed database, administration interface, or other service.

Scheduled port scans run hourly from the host's public network interface. A port's reachability from this location can differ from its reachability from another network, especially when you restrict access by source IP.

An open port means the scanner observed a reachable service. It is not automatically a vulnerability: a public website is expected to expose its web service. If a service is unfamiliar, confirm what is listening inside the VPS and whether it needs public access. Restrict or stop services you do not need.

Service identification is evidence from a probe, not a complete list of installed software. A row labelled only with a port number does not confirm which application is running. Per-port traffic is not measured; application traffic is shown separately.

Vulnerability scanning and the tracker

Vulnerability scanning adds context to the open-port results. Where assessment is available, Aegis uses the identified service and version to surface potential matches to known vulnerabilities from NIST's National Vulnerability Database (NVD). A CVE identifier names a publicly catalogued vulnerability; severity helps you decide what to investigate first.

Treat findings as prompts to review the affected service. A version match does not prove that your particular installation is exploitable: configuration, vendor fixes, and patches backported without changing the advertised version can affect whether a finding applies. An unidentified service may be impossible to assess from the available evidence.

For a finding you need to investigate:

1. Confirm the instance, IP, port, service, and observation time.
2. Read the vulnerability details and the software vendor's guidance. Check the version and patch status actually installed on your VPS.
3. Apply the appropriate update or configuration change. Restrict public access to the affected service if it does not need to be exposed.
4. Review fresh scan and assessment results after making changes. Older findings describe older observations and may remain visible until results update.

Aegis does not install patches, change your firewall rules, or remove vulnerable software for you. No findings is not a guarantee that a server is secure, and an open-port scan alone is not a completed vulnerability assessment.

Understand incomplete or old results

Check the observation time and coverage before drawing conclusions:

• Partial or failed port scans: some checks did not complete. A firewall, unavailable service, or unresponsive UDP port can leave reachability unknown.
• Retained or stale ports: an earlier open-port observation can remain after an incomplete attempt. Its original time matters; an omitted port is not proof that it closed.
• Pending, unavailable, or unable-to-assess vulnerability results: the service has not been successfully assessed. These states are not a clean bill of health.
• Missing traffic: gaps mean observations are unavailable, not necessarily that the server had no traffic. The traffic time-window selector does not make an old port scan fresh.

The application view describes observed network traffic rather than every installed application. Its byte totals are not your billed bandwidth usage. An application stays listed for 24 hours after its last observed outbound traffic on the same IP and application port, including replies. New outbound traffic restarts that timer; inbound traffic and port scans do not. Application totals cover the last 24 hours independently of the dashboard's chart range.

Disable or re-enable Aegis

1. Open Aegis → Settings.
2. Clear Enable LayerOne Aegis for my account.
3. Select Save Aegis setting.

This setting applies to all devices in your account. Disabling it hides the Aegis dashboard, applications, ports, and attack activity, and pauses customer DDoS and vulnerability alerts. Your saved alert preferences and retained observations are preserved, subject to normal retention.

Disabling Aegis does not stop underlying security monitoring or turn off LayerOne's DDoS protection. The setting controls the customer views and alerts; it is not a request to stop infrastructure scanning.

To return, open Aegis Settings, select the checkbox, and save. If you only want fewer DDoS notifications, change Alert preferences instead. In-app DDoS alerts are on by default; email alerts are opt-in. Those preferences also let you choose a minimum severity and whether to receive an email when an attack ends.

How Aegis fits into your security

Use Aegis to spot unfamiliar activity and investigate it. Traffic visibility does not automatically identify or block an intrusion. LayerOne's included L3/L4 DDoS mitigation is a separate layer of protection; you still manage operating-system updates, application security, credentials, and firewall rules.

For missing scanner details, persistent scan failures, or help understanding a finding, open a ticket. Include the instance name, public IP, affected port or CVE if available, and the time and status of the result you are reviewing. Never include your VPS password or API keys.

Related

• LayerOne Aegis overview
• Cloud firewall and Firewall Groups
• DDoS mitigation