Gatebot vs. 754 Mpps: Cloudflare Defends Against a Four-Day Flood
On June 21, Cloudflare's automated DDoS mitigation systems intercepted an attack that peaked at 754 million packets per second (Mpps). The assault was part of a coordinated campaign that ran from June 18 through June 21, originating from more than 316,000 IP addresses and aimed at a single Cloudflare IP address primarily serving websites on the Free plan. No downtime or service degradation occurred, and thanks to Cloudflare's unmetered mitigation guarantee, customers incurred no charges.
What makes this particular incident notable is not just its scale, but the absence of human involvement. The attack was identified and neutralized entirely by Gatebot, Cloudflare's global detection and mitigation system. No alerts were triggered, no pages were sent to on-call engineers, and no one was woken up—the systems simply handled it. The peak occurred while Cloudflare's London team slept.
How Packet Floods Differ From Other DDoS Types
DDoS attacks can be roughly categorized by the metric they target: bits per second, packets per second, or requests per second. A bit-intensive assault aims to saturate an Internet link by pushing more bandwidth than the connection can handle. Think of a dam holding back a gushing river—only a fraction of the flow can be allowed through. When the link is saturated, everything behind it goes offline; when an ISP steps in, legitimate users may be throttled or blocked entirely.
The June attack, however, wasn't trying to do that. At roughly 250 Gbps, it never approached the limits of Cloudflare's global capacity, which exceeds 37 Tbps. Instead, the attacker's goal was to overwhelm the equipment—routers, switches, firewalls, and other in-line appliances—with sheer packet volume. If a river is the right metaphor for a bit flood, a packet flood is more like a swarm of millions of mosquitoes: each one needs to be zapped individually.
Every packet carries a small fixed CPU cost in the hardware that processes it. The danger is that an attacker doesn't need to fill your pipe—they just need to send enough small packets to max out the processing capacity of the gear handling them. At high enough packet rates, memory buffers overflow and routers can no longer process additional traffic. Attackers sometimes prefer small header-only packets precisely because they generate high packet rates at relatively low bandwidth.
With that in mind, the attacker used what appears to be a deliberate strategy: keep the packet rate above 400–600 Mpps for hours at a time, exceeding 700 Mpps multiple times, with the top peak at 754 Mpps. Rates like those aren't designed to clog a link—they're meant to choke the CPUs handling the traffic. Cloudflare's edge kept serving customers throughout, with no sign of performance degradation.
There's a third category worth distinguishing: HTTP request floods. These target web server resources directly, sending more requests per second than the server can process. The aim is to exhaust CPU and memory, crashing the server or making it unable to respond to legitimate requests. Request floods typically require far less bandwidth than bit floods yet can still produce a denial of service.
Automated Defense: Anycast, Gatebot, and dosd
For this campaign, the attacker deployed SYN floods, ACK floods, and SYN-ACK floods over TCP. Defense rested on three layers: BGP Anycast spread the attack traffic across Cloudflare's global data center fleet; proprietary systems Gatebot and dosd dropped malicious packets inside the Linux kernel for efficiency; and the custom L4 load balancer Unimog distributed traffic within data centers based on appliance health and other metrics carefully enough that no single machine was overwhelmed.
Gatebot works by asynchronously sampling traffic from every one of Cloudflare's 200+ global data centers while also monitoring the health of customers' origin servers. It analyzes the samples for traffic patterns and anomalies that might signify an attack, and when it finds one, it sends mitigation instructions to the edge. Dosd, introduced last year, operates on a smaller scale—running in every city and handling detection and mitigation autonomously at the level of a single server or data center.
Volumetric Attacks Persist Even as Trends Shift
Even with a recent observed decrease in DDoS attack size and duration, campaigns like this one prove that highly volumetric, globally distributed assaults remain a real threat. Cloudflare's response—unmetered DDoS protection across all customers and plan levels, including Free—continues to apply regardless of the attack's scale, type, or sophistication.
