Tracking TCP State From One Side of the Connection Only
Cloudflare’s Magic Transit L3 DDoS scrubbing service is getting a new software-defined component called flowtrackd. It is designed to detect and mitigate complex TCP-based DDoS attacks that stateless packet filtering cannot handle. For existing Magic Transit customers, the feature will be enabled by default on July 30, 2020, at no additional cost.
Why Stateless Filtering Falls Short
During the first quarter of 2020, over 66% of all L3/4 attacks mitigated by Cloudflare were TCP-based, with ACK floods accounting for one in two L3/4 attacks overall. Many of these can be stopped by stateless mitigation — finding a unique characteristic present in all attack packets and dropping anything that matches. The problem is that sophisticated TCP floods do not always carry such fingerprints.
When attack packets look identical to legitimate ones, mitigation must be stateful: a packet is only "good" or "bad" in the context of the connection it claims to belong to. This is flow tracking, and it is typically done in Linux via the iptables conntrack module. But running conntrack at Cloudflare’s scale and complexity is not a simple configuration change — the engineering challenges of that approach are covered in Cloudflare’s earlier conntrack blog post.
Reverse Proxy vs. Asymmetric Routing
For services like the WAF and Spectrum, Cloudflare operates as a reverse proxy: traffic passes through in both directions. That means the full TCP flow is visible — segments from both client and server — so the state of each connection can be tracked. Any packet that does not belong to an established flow is classified as out of state and dropped. This bidirectional visibility makes flow tracking feasible.
Magic Transit, however, is different. Cloudflare receives inbound traffic on behalf of the customer, scrubs it, and forwards clean traffic to the origin data center over a tunnel. The origin then replies directly to the client using Direct Server Return (DSR), bypassing Cloudflare entirely. The result is asymmetric routing: Cloudflare only sees the ingress half of the connection.
In a normal TCP handshake routed through Magic Transit, the client’s SYN goes through Cloudflare to the origin; the origin’s SYN-ACK goes straight back to the client; and the client’s final ACK again passes through Cloudflare. Because the SYN-ACK is invisible to Cloudflare, the existing bidirectional flow tracking cannot determine whether packets following the handshake are in state or not.
flowtrackd: A State Machine for Half-Duplex Visibility
To solve this, Cloudflare built and deployed flowtrackd, a state machine that hooks into the network interface. Using only the ingress traffic that routes through Cloudflare, flowtrackd decides whether to forward or drop each TCP packet based on the state of the associated connection. The state machine logic was developed in-house and complements Cloudflare’s existing mitigation systems, Gatebot and dosd, providing a multi-layered DDoS defense.
The system has already been validated in production. Less than a day after rolling out to an early access customer, flowtrackd automatically detected and mitigated an ACK flood peaking at 6 million packets per second — with no reported downtime, service disruption, or false positives.
Edge-Wide DDoS Protection
Unlike legacy scrubbing centers, which rely on limited network infrastructures and third-party appliances, Cloudflare runs DDoS protection software from every one of its 200+ data centers. Writing its own software-defined systems means Cloudflare can deploy specialized components in the optimal part of the stack without depending on a single vendor’s appliance capabilities.
flowtrackd is now part of that family, alongside Gatebot and dosd. It will be available from every Cloudflare data center, adding to a total mitigation capacity of over 37 Tbps for protecting Magic Transit customers against sophisticated TCP DDoS attacks.
