An ACK Flood That Followed a Beat Pattern
During the week of Black Friday, Cloudflare's automated defenses intercepted a peculiar ACK DDoS attack targeting a Magic Transit customer. The attack, codenamed "Beat," didn't stand out for its size — it was the waveform of the attack that drew attention. The packet rate oscillated in a wave-like pattern for over 19 hours, mimicking a phenomenon from acoustics.
In acoustics, a "beat" occurs when two waves of slightly different frequencies interfere. When they are nearly 180 degrees out of phase, their superposition creates periodic amplification and cancellation. The attacker appears to have applied this same principle to network traffic, generating a flood whose packet rate followed a beat wave equation.
Modeling the Attack Waveform
The packet rate was shaped by the superposition of two wave equations, where the frequency of each wave and time determine the instantaneous rate. By scaling the combined wave and adding a constant offset, the attacker controlled the amplitude and baseline of the flood, cycling the packet rate between roughly 18M and 42M packets per second.
Reverse-engineering the pattern, the attack can be approximated with two frequencies: f1 = 0.0000345 and f2 = 0.00003455. Those values produce a graph closely matching the observed attack traffic. If the flood was distributed across a botnet of b bots, each node's contribution would be the total equation divided by the number of bots.
Why the Pattern Didn't Work
The rhythmic rise and fall may have been an attempt to evade DDoS mitigation systems, but it failed. Cloudflare's flowtrackd, a unidirectional TCP state tracking system, identified the packets as ACK floods that belonged to no established TCP connection. The attack traffic was dropped automatically at the edge.
Over the two-day attack window, traffic peaked at ~42 Mpps with an amplitude of ~7 Mpps and a wavelength of roughly 4 hours. Cloudflare's systems logged over 700 DDoS attacks against the same customer during that period. The cumulative attack traffic approached 500 Terabytes, part of 3.6 Petabytes of attack traffic aimed at this customer in November. The attackers cycled through ACK floods, UDP floods, SYN floods, Christmas floods (all TCP flags set), ICMP floods, and RST floods.
TCP State Challenges in Asymmetric Routing
TCP is stateful, so distinguishing legitimate packets from out-of-state attacks often requires connection tracking. For Cloudflare's classic WAF/CDN and Spectrum services, the reverse-proxy architecture sees both ingress and egress traffic, making tracking straightforward. Magic Transit, however, relies on asymmetric routing with direct server return (DSR), which breaks that model.
Rather than deploying dedicated hardware appliances, Cloudflare built flowtrackd to run autonomously on every edge server. It analyzes only ingress traffic to classify TCP flow states, then drops, challenges, or rate-limits packets that don't match an existing flow. The system works alongside dosd and Gatebot, forming a layered defense that handled the Beat attack without manual intervention.
