How Cloudflare auto-mitigated a world record 3.8 Tbps DDoS attack

A month of record-breaking floods

Starting in early September, Cloudflare's autonomous DDoS protection systems have been engaged in a sustained campaign against hyper-volumetric L3/4 attacks. Over a single month, the defenses mitigated more than one hundred such events. Many of these attacks exceeded 2 billion packets per second (Bpps) and 3 terabits per second (Tbps). The peak event reached 3.8 Tbps—the largest attack volume any organization has publicly disclosed to date.

These attacks targeted a single Cloudflare customer across multiple events. The mitigation was entirely automated, with no human intervention required for detection or response.

Who is at risk

Organizations already using Cloudflare's HTTP reverse proxy services—including the WAF and CDN—received automatic protection. The same applies to customers on Spectrum and Magic Transit. Magic Transit users can tighten their posture further by deploying Magic Firewall rules to enforce strict positive and negative security models at the packet layer.

The scale of this campaign is not a theoretical concern. Attacks of this magnitude can overwhelm unprotected properties, as well as those relying solely on on-premise mitigation gear or cloud providers lacking the network capacity and global footprint to absorb such floods while still delivering legitimate traffic.

Anatomy of the campaign

The campaign struck multiple sectors, including financial services, Internet infrastructure, and telecommunications. The attackers aimed at both saturating bandwidth and exhausting the CPU resources of in-line applications and devices.

The attacks relied predominantly on UDP traffic sent to a fixed port, coming from sources distributed globally. The largest share of packets originated from Vietnam, Russia, Brazil, Spain, and the US.

Two distinct device populations powered the attacks. High packet rate floods came from a mix of compromised MikroTik devices, DVRs, and web servers orchestrated to act in concert. The high bitrate floods traced back to a large number of compromised ASUS home routers, exploiting a critical vulnerability (CVE 9.8) recently documented by Censys.

How L3/4 attacks work

A DDoS attack aims to deny legitimate users access to a service by exhausting the resources that service depends on. For L3/4 attacks, those resources are CPU cycles and network bandwidth.

CPU exhaustion

Every packet that arrives consumes CPU cycles simply to be parsed and routed, before any application logic even runs. Layer 3 headers must be inspected to direct the packet to the right interface; Layer 4 headers determine the correct socket. If an attacker can deliver packets faster than the CPU can process them, legitimate packets get starved.

The defense against high packet rate floods is to inspect and discard malicious packets with minimal CPU overhead, reserving processing power for genuine traffic. Simply adding more or faster CPUs can help, but that approach is slow and expensive.

Bandwidth saturation

Network bandwidth is the volume of data that can be delivered to a server per unit of time. When an attacker pushes more garbage data into the pipe than it can carry, both good and bad data are dropped at the ingress point—an effective denial of service.

Defending from the downstream side of a saturated link is tough. Options are limited: procure a larger pipe, reroute legitimate traffic to an unsaturated path, or persuade the upstream carrier to stop forwarding the attack traffic.

Why attacks are feasible

From the attacker's perspective, the constraints mirror those of the defender. Generating packets takes CPU cycles, though often far fewer than the cycles needed to receive and process them. This asymmetry makes attacks cost-effective, though not free—large botnets still require substantial computing resources.

Saturating bandwidth is harder. It requires the attacker to send more traffic than the target can receive, a bar most botnets cannot clear alone. That is why reflection and amplification techniques, such as DNS amplification, are common: a small packet sent to an intermediary yields a much larger packet directed at the victim.

In either case, attackers need a botnet. That pool can include cloud-hosted servers or compromised consumer devices like DVRs, webcams, and routers, all infected with malware and coordinated to generate massive traffic volumes.

The mechanics behind the mitigation

Cloudflare’s defense begins with network architecture. The backbone of the approach is anycast: a single IP address is announced from many locations around the world, and packets destined for that address are routed to the nearest available machine. When a distributed botnet launches a volumetric attack, the flood is split geographically instead of hammering one destination. An infected device in Dallas sends traffic to a nearby Cloudflare data center, and a compromised device in London does the same — the attack load is naturally spread across the entire network rather than being concentrated at a single point of failure.

This distribution also lets Cloudflare scale resources where they are most needed. Data centers in densely populated regions handle more legitimate traffic and carry more bandwidth and compute capacity; less-trafficked regions are sized accordingly. Since compromised devices tend to be distributed similarly to normal user traffic, the attack traffic is spread proportionally to the data centers best equipped to absorb it.

There is also a bandwidth asymmetry that works in Cloudflare’s favor. A typical HTTP request is small inbound but generates a larger outbound response, so the network egresses far more data than it receives. Network links are symmetric, however, which leaves an abundance of ingress capacity to receive volumetric attack traffic without saturating upstream links.

Sampling, fingerprinting, and dropping at the NIC

Once traffic reaches an individual server, the attack’s bandwidth has been diluted enough that links are no longer in danger. The next problem is identifying and dropping bad packets. That job falls to l4drop, which uses XDP (eXpress Data Path) and an extended version of the Berkeley Packet Filter called eBPF. These tools allow custom code to run in kernel space and process — drop, forward, or modify — every packet directly at the network interface card (NIC) level, keeping CPU usage low.

XDP is used to sample packets and look for suspicious attributes: source IP, source port, destination IP, destination port, protocol, TCP flags, sequence number, options, packet rate, and more. The analysis itself is performed by the denial of service daemon (dosd), which runs a set of filters based on curated heuristics that determine when mitigation should begin. These filters are grouped by attack vector and exposed to customers as the DDoS Managed Rules, which can be customized as needed.

As XDP feeds samples to dosd, the daemon generates multiple permutations of fingerprints for suspicious traffic patterns and uses a data streaming algorithm to determine the most effective fingerprint for mitigation. Once an attack is qualified, dosd pushes a rule into the kernel as an eBPF program that surgically drops the offending traffic.

Detection and mitigation happen at the server, data center, and global levels — all software-defined and fully automated. There are no out-of-path scrubbing centers or special-purpose devices; each server runs the complete Cloudflare product stack, including the DDoS detection and mitigation component. Servers gossip, or multicast, mitigation instructions within a data center and across data centers globally, so that whether an attack is localized or globally distributed, inline mitigation rules are already in place.

Multiple defense layers

Dynamic fingerprinting is only one part of a larger defense portfolio. The Advanced TCP Protection and Advanced DNS Protection systems complement it by identifying highly randomized TCP-based attacks and using statistical analysis to counter complex DNS floods. Adaptive DDoS Protection adds real-time threat intelligence, traffic profiling, and machine learning classification to catch traffic anomalies that might evade rule-based detection.

All of these systems run on the same global anycast network, which is among the largest in the world. That combination of scale and autonomous, software-defined mitigation is what allows Cloudflare to absorb and stop attacks at this level.