Layer 3/4 DDoS Rulesets Now Configurable

Cloudflare is extending managed DDoS protection controls from the HTTP layer down to layers 3 and 4 of the OSI model. Enterprise customers using Magic Transit and Spectrum can now tune their packet-layer DDoS settings directly from the dashboard or via the API, without needing to open a support ticket.

The new controls apply to two distinct rulesets:

  • Network-layer DDoS Protection ruleset — Detects and mitigates attacks such as UDP floods, SYN-ACK reflection attacks, SYN floods, and DNS floods. Available for Spectrum and Magic Transit customers on the Enterprise plan.
  • Advanced TCP Protection ruleset — Handles sophisticated out-of-state TCP attacks, including spoofed ACK floods, randomized SYN floods, and distributed SYN-ACK reflection attacks. Currently restricted to Magic Transit customers.

How the Autonomous Mitigation Works

Cloudflare's DDoS protection is delivered by autonomous, software-defined systems that run across the network edge. The protection is unmetered and unlimited, with no bounds on attack size, frequency, or duration. This matters as attacks continue to grow; Cloudflare recently mitigated a multi-vector DDoS attack peaking just below 2 Tbps, and Q3 network-layer attacks rose 44% quarter-over-quarter.

The Network-layer DDoS Protection ruleset is built from managed rules, each with its own conditional fingerprints, dynamic field masking, activation thresholds, and mitigation actions. Cloudflare's DDoS experts curate these rules in-house, and new rules are tested across the global network before deployment.

The Advanced TCP Protection ruleset is powered by flowtrackd, a TCP state classification engine. It can operate using only ingress packet flows, qualifying TCP flows and tracking their state to drop, challenge, or allow packets. ACK floods that don't match open TCP connections, for instance, get dropped.

For the Network-layer ruleset, detection uses streaming algorithms. Packet samples are compared against fingerprints, creating real-time signatures via dynamic masking. Each matching packet increments a counter; once the activation threshold is hit, a mitigation rule is compiled and pushed inline with the appropriate action.

Dynamic Masking in Practice

Consider a fingerprint matching on source IP, source port, destination IP, and TCP sequence number. A flood with a fixed sequence number would trip the counter quickly. But a spoofed attack randomizing source IPs and ports would fragment the signatures. Dynamic masking solves this by ignoring fields that aren't strong indicators — masking source IP and port lets all attack packets match on the unique sequence number alone, regardless of how distributed the attack is.

What You Can Configure

Cloudflare has exposed a subset of the Network-layer DDoS protection rules it expects will need customization most often, with more rules to come over time.

For each exposed rule, you can now override:

  • The sensitivity level, which controls the activation threshold
  • The mitigation action
  • Expression filters to include or exclude traffic based on packet fields, using the ruleset's field definitions

Multiple overrides can be created to fine-tune protection per network or per application.

Advanced TCP Protection Limits

Configuration of the Advanced TCP Protection ruleset is more constrained for now. You can enable or disable the entire ruleset from the dashboard; per-prefix toggling requires the API. Initial onboarding still requires Cloudflare to create a policy, and changing sensitivity thresholds, enabling Monitor mode, or adding filter expressions means contacting Support. These capabilities are planned for dashboard and API availability in future releases.

Existing Customizations Preserved

Customers who previously requested DDoS protection customizations through Cloudflare Support will find those settings intact. Network-layer DDoS Protection overrides can now be viewed and edited in the dashboard. Advanced TCP Protection changes still require a support request.

No action is needed if you haven't customized anything. To review or adjust your settings, consult the dashboard guide or the API documentation for programmatic configuration.