Traffic anomalies and notifications with Cloudflare Radar

Radar expands anomaly detection and notification feeds

Cloudflare has expanded its Radar Outage Center (CROC) with a live feed of traffic anomalies detected at country and network level. The new feed is also available via the Radar API, alongside new notification subscriptions covering traffic anomalies, confirmed Internet outages, route leaks, and route hijacks. Subscriptions are tied to the Cloudflare dashboard's existing notification engine, with delivery via email or webhooks depending on plan level.

What counts as an anomaly

Internet traffic follows broadly predictable daily patterns, but weekends, holidays, and national events shift both volume and shape. The more significant concern for operators is drastic traffic drops, which can point to infrastructure damage from weather or natural disasters, or deliberate government-ordered Internet shutdowns. In the latter case, timely insight is often critical for organizations tracking communications and human rights in affected regions.

The Cloudflare Radar team has been using an internal tool to flag these anomalies and route them to a dedicated chat space for follow-up. The companion post Gone Offline: Detecting Internet Outages details the traffic analysis and anomaly detection methodologies behind that tool. What was previously internal is now public: the Outage Center presents a Traffic anomalies table with anomaly type (location or ASN), the affected entity, start time, duration, verification status, and an Actions column for viewing the anomaly on the relevant traffic page or subscribing to notifications. Anomalies confirmed across multiple Cloudflare datasets and/or visible in third-party sources like Georgia Tech's IODA platform are marked verified; unverified anomalies may be false positives or related to Netflows collection issues.

The Outage Center map now also highlights detected anomalies as orange circles, with double-bordered circles indicating aggregation across multiple countries. Zooming in reveals per-country anomaly counts. A new timeline below the map places anomalies in broader temporal context; hovering over individual dots surfaces outage or anomaly details. Traffic anomalies are queryable through a dedicated Radar API endpoint alongside the existing outage annotations API.

Setting up notifications

Notification subscriptions aim to serve several audiences: customer support teams diagnosing user complaints, network administrators understanding conditions outside their own network, and civil society organizations maintaining communications in unstable regions. To configure notifications, you need to be logged into the Cloudflare dashboard — no purchase is required, but the login is necessary to reuse Cloudflare's existing notification engine rather than building one specifically for Radar.

The notification icon (bullhorn) appears in the Traffic, Routing, and Outage Center sections of Radar where subscriptions are available. On a country or ASN-scoped page, subscriptions are scoped to that entity. Clicking an icon opens the Add Notification page in Cloudflare, pre-filled with the context passed from the Radar page. Users can name the notification, add descriptions, adjust location and ASN filters, and add email addresses or select a webhook destination. Notifications can also be created directly in the Cloudflare dashboard by navigating to Notifications, selecting "Radar" as the product, and configuring event types and filters from scratch. If no location or ASN filters are selected, notifications fire for all events of the chosen types. Advanced users can configure everything programmatically via the Cloudflare API Notification policies endpoint.

Notification contents

Email notifications differ by event type but all include core details such as affected entities and start time. Outage notifications include cause description, scope where available, and outage type (Nationwide, Network, Regional, or Platform). BGP hijack notifications cover hijacking and victim ASNs, affected prefixes, number of peers announcing the hijack, detection timing, confidence level, and relevant tags. Route leak notifications include source and leaking ASNs, affected prefixes and origin ASes, the number of route collector peers that observed the leak, and detection timing. Each includes links to view the event in Radar.

For webhook delivery, notifications can be routed into tools like Slack for real-time operational awareness. Plaintext and HTML versions of email are provided to accommodate different clients.

With the notification feed, teams no longer need to poll Radar for new events — the latest anomalies and routing incidents relevant to configured countries and ASNs are delivered automatically, which should make it easier to fold Internet-level observability into incident response and monitoring workflows.