A research-led week for a healthier Internet
Cloudflare’s Research team is publishing a series of posts this week centered on measurement, resilience, and transparency. The work comes out of collaborations with academia, the IETF, open-source projects, and Cloudflare’s own product and engineering teams. The goal is to share findings in the open, and to ground hypotheses in real-world network data rather than simulation alone.
The timing is deliberate: posts on Internet measurement coincide with the ACM’s annual Internet Measurement Conference. Measurement is notoriously difficult to do correctly at scale, so these pieces aim to explain the foundational concepts and tradeoffs behind Cloudflare’s own approach.
What Internet measurement really involves
The week opens with a primer on Internet measurement itself—what it consists of, the jargon, and the fundamental tradeoffs required to do it well. A former Cloudflare intern will also explain how working with Cloudflare-scale data shifted his perspective on detecting connection tampering. Other posts look at how Cloudflare Radar has evolved and how the Internet speed test works under the hood.
Defining resilience, from outages to quantum threats
A network’s ability to withstand, adapt to, and recover from disruptions is something users notice only when it fails. Causes range from cyberattacks to natural disasters to government-directed shutdowns. The quarterly Internet Disruption Summary will detail the length and impact of outages as observed from Cloudflare’s network.
To make the concept actionable, one post establishes a framework for Internet resilience, intended for governments, infrastructure providers, and researchers to assess their infrastructure from first principles.
Resilience also extends to cryptographic readiness. Since the publication of the State of the Post-Quantum Internet report, deployment progress has continued. An updated view of post-quantum adoption will be shared, alongside a deep dive into Merkle Tree Certificates—an experimental design with Chrome aimed at making post-quantum certificates deployable at scale.
Inside Cloudflare’s network: connections, hardware, and limits
Cloudflare handles millions of connections and IP addresses per second. Characterizing these at scale requires understanding what a connection actually means server-side—what is observed, measured, and what that reveals about data flow across the Internet.
Several posts will go into the engineering behind that scale, including how Cloudflare extends its Linux networking stack to save address space without sacrificing performance. These techniques feed directly into real-world applications: detecting shared IP space (CGNAT), defending against DDoS attacks, and improving cache efficiency.
Cryptographic protocols for an automated web
The rise of AI agents and crawlers is changing traffic patterns dramatically. Much user traffic is now funneled through a small number of large datacenters, and request patterns increasingly reflect automated orchestration by LLMs. Measuring these shifts is becoming a complex problem in its own right.
This week’s posts will examine how honest agents and website operators can cooperate to maintain safety, privacy, and resilience. One focus is new work in the IETF building on Web Bot Auth, a protocol that lets automated HTTP clients identify themselves. Additional proposals cover cryptographic protocols to let legitimate users through while protecting sites from DDoS, fraud, or scraping. These designs include deployment considerations and mechanisms to prepare for the post-quantum transition.
Expectations for the week
The upcoming posts span emerging research, new frameworks, and practical deployment experience. They aim to bridge academic theory and real-world engineering, with a focus on measurable and actionable outcomes.
