Cloudflare’s network has grown from a single transit provider in 2010 to more than 500 Tbps of provisioned external capacity across 330+ cities. The company argues that this scale is not merely about bandwidth: it enables security decisions, application execution, and routing validation to happen locally on every server. Its distributed architecture can absorb massive attacks automatically while supporting edge computing and emerging Internet protocols.
## From Transit Provider to Global Network
- Cloudflare began with nLayer Communications as its first transit provider.
- Expansion required city-by-city work: colocation contracts, fiber installation, hardware deployment, and Internet exchange peering.
- In 2018, Cloudflare opened 31 cities in 24 days, despite logistical challenges such as customs delays and missing equipment.
- The network now spans more than 330 cities and protects over 20% of the web.
- The 500 Tbps figure represents provisioned interconnection capacity across transit, private peering, Internet exchanges, and Cloudflare Network Interconnect ports—not peak traffic.
## Turning the Network into a Security Layer
- Cloudflare expanded from caching websites to securing employees and enterprise networks.
- Its systems establish secure tunnels to private subnets and advertise customer IP space through BGP.
- In 2025, Cloudflare mitigated a 31.4 Tbps DDoS attack lasting 35 seconds.
- The attack was part of more than 5,000 attacks blocked that day, without paging an engineer.
- Distributed automation allows attacks that once required nation-state resources to be handled in seconds.
## Packet-Level DDoS Mitigation
- Incoming packets enter an XDP program chain in driver mode immediately after reaching the network interface card.
- The `l4drop` eBPF program applies mitigation rules generated by `dosd`, Cloudflare’s denial-of-service daemon.
- Each server identifies heavy traffic sources and shares the information across its colocation facility.
- Mitigation rules spread globally through Quicksilver, Cloudflare’s distributed key-value store.
- Only legitimate traffic reaches Unimog, the Layer 4 load balancer; Magic Transit traffic receives additional stateful inspection through `flowtrackd`.
- The 31.4 Tbps attack was stopped at line rate without centralized scrubbing or human intervention.
- Sufficient physical port capacity remains essential: software defenses cannot work if the network cannot first absorb the traffic.
## A Developer Platform at the Edge
- Because Cloudflare already runs software on every server for packet filtering, it extended the same infrastructure to customer code through Workers.
- Workers, KV, and Durable Objects run across Cloudflare’s global footprint rather than in a small number of cloud regions.
- Workers Containers, introduced in 2025, support heavier workloads at the edge.
- V8 isolates and custom filesystem layers reduce cold-start times.
- Applications run on the same servers that discard malicious traffic before it reaches the network stack.
## Securing Routing with RPKI and ASPA
- Cloudflare uses IPv6 and RPKI to reduce the risk of BGP hijacks.
- It signs Route Origin Authorizations and rejects routes that fail Route Origin Validation, even when misconfigured networks become temporarily unreachable.
- ASPA will extend protection by validating the network path, not just the organization authorized to originate a prefix.
- The post compares RPKI to checking a destination passport and ASPA to verifying the entire flight manifest.
- Cloudflare says 867,000 prefixes now have valid RPKI certificates, compared with nearly none a decade ago.
- The company promotes early adoption of routing security standards because delays leave the Internet exposed to hijacks and route leaks.
## AI Agents and Internet Traffic
- AI crawlers, training systems, and autonomous agents now generate more than 4% of HTML requests on Cloudflare’s network.
- Human-initiated “user action” crawling increased more than 15-fold in 2025.
- Unlike browsers, crawlers may retrieve every linked resource at maximum speed, making legitimate activity difficult to distinguish from attacks.
- Cloudflare uses verified bot IP ranges, TLS fingerprints, behavioral analysis, and robots.txt signals to classify AI crawlers.
- These signals help site owners decide which automated agents to permit.
Cloudflare’s central lesson is that a global network must combine abundant capacity with intelligence distributed across every server. Its continued investment in automated mitigation, edge execution, routing security, and traffic classification is intended to make the Internet faster, safer, and more resilient as traffic patterns evolve.
