Network Analytics: A new view into Cloudflare’s edge
Cloudflare has released a rebuilt Network Analytics dashboard for its Magic Transit and Spectrum products on the Enterprise plan. The goal is to give network operators a sharper, more granular view of traffic behavior, firewall events, and DDoS attacks as they are observed across Cloudflare’s global network. Key data points include top traffic and attack attributes, visibility into DDoS mitigations and Magic Firewall events, and detailed packet samples with full headers and metadata.
This release follows a complete refactoring of Cloudflare’s network-layer logging pipeline. The new pipeline is decentralized, which makes it more resilient, performant, and scalable for future integrations with new mitigation systems, sampling points, and services. The dashboard’s primary functions are to help operators understand their network, respond faster to DDoS attacks, and generate security reports with ease.
Gaining visibility into traffic and mitigations
At the top level, the dashboard presents traffic rates over time alongside total throughput. Operators can filter the entire view, use select-to-zoom, adjust the time range, and toggle between packet and bit/byte views. This helps spot sudden dips or surges that might signal trouble. Customers who advertise their own IP prefixes from Cloudflare’s network also see annotations for BGP advertisement and withdrawal events, adding context to the traffic data.
A notable feature is the dashboard’s geographical accuracy. Because network-layer traffic is subject to IP spoofing, correlating source IP addresses to a city or country can produce misleading results—a “spoofed country.” Instead, Cloudflare relies on the location of the data center where traffic was ingested. With data centers in over 285 locations and BGP Anycast routing traffic to the nearest point of presence, this provides high-granularity geoinformation without the spoofing problem.
Mitigation-level detail
The All traffic tab offers a summary of attack traffic dropped by three mitigation systems and the clean traffic passed through to the origin. Each additional tab focuses on one mitigation system, showing what it dropped and what it allowed through. This mirrors the visibility Cloudflare’s internal support teams have, letting customers see exactly where in the stack an action was taken.
For example, the Advanced TCP Protection tab shows how the system classifies TCP connection states, revealing the distribution of packets by state. A sudden spike in Out of sequence packets, for instance, may signal that the system is dropping them. Note that Spectrum customers see a slightly different set of tabs—they do not have access to Advanced TCP Protection or Magic Firewall.
Responding to attacks with pattern analysis
When a network operator sees a sudden traffic surge, they need to know if it is a legitimate spike—say, from a new game release—or an unmitigated attack. The dashboard’s time-series grouping helps answer this quickly. The default dimension is outcome (whether traffic was dropped or passed), but operators can switch to other fields like TCP flag, Packet size, or Destination port to reveal a pattern.
Consider an example where an operator zooms in on a traffic surge. Setting Protocol as the grouping dimension shows a 5 Gbps spike of UDP packets—totalling 840 GB of the 991 GB throughput in that period. Filtering by UDP, the operator can then group by Source port, revealing that 838 GB comes from port 123. Further iteration with the Packet size dimension shows over 771 GB arriving in 286-byte packets. At that point, the attack is sufficiently patterned to build a targeted Magic Firewall rule, combining these fields (and optionally limiting scope to a specific prefix like 192.0.2.0/24) to avoid blocking legitimate traffic.
When more forensic detail is needed, the dashboard supports viewing and exporting packet samples with full headers, useful for attack mitigation or network troubleshooting.
Building reports for stakeholders
Network security teams often need to present an accurate threat landscape to decision makers. The Network Analytics dashboard supports this by letting users filter and tune a custom report that shows which endpoints are targeted, by what attack types, from where, and how that compares to the previous period. Magic Transit and Spectrum users also receive an automated weekly Network DDoS Report summarizing key insights and trends.
Extending visibility beyond the dashboard
Being unprepared for DDoS attacks can lead to revenue loss, reputational damage, and burned-out teams—and for critical infrastructure like healthcare or utilities, the stakes are even higher. The Network Analytics dashboard is designed to cut the time spent investigating and resolving issues, and to simplify security reporting. The underlying data is also accessible via GraphQL API and Logpush, allowing teams to integrate it into internal systems and correlate it with other data sources.
