CLOUDFLARE // MAGIC TRANSIT

Network attack surface,
reduced to zero.

GLOBAL EDGE ONLINE

BOTNET A

San Francisco, US

BOTNET B

Washington, DC

BOTNET C

London, UK

BOTNET D

Sydney, AU

LEGIT USERS

San Francisco, US

LEGIT USERS

Washington, DC

GLOBAL NETWORK

ANYCAST ROUTE ANNOUNCEMENT

YOUR NETWORK

data center · cloud · branch

PROTECTED ON-RAMPSGRE / IPsec / CNI

GRE TUNNELIPsec TUNNELCNI

BGP UPDATE FROM CUSTOMER

203.0.113.0/24
198.51.100.0/24

announced via tunnel / peering

DISTRIBUTED ATTACK ABSORBED AT THE EDGE

Advertise your /24 or larger prefixes from your network to Cloudflare. The global edge propagates reachability so inbound traffic is drawn to a nearby PoP.

BGP PREFIX ADVERTISEMENTBAD TRAFFICGOOD TRAFFIC