company · deep · draft
Cloudflare (anycast edge & Unimog)
Cloudflare publishes a global anycast edge (AS13335) with a uniform server stack per city and an in-PoP path of ECMP → XDP/eBPF (l4drop) → Unimog L4 load balancing. Peering policy and Myriagon milestones are public; a hyperscaler-style private WAN TE paper is not.
In one sentence. Explaining Cloudflare’s published anycast + in-PoP data path without inventing backbone TE, exact current city counts, or non-edge core fabrics.
Why it exists
Anycast puts CDN, DNS, security (WAF/DDoS), and related services on the same edge stack so users reach a nearby city and attack traffic is naturally distributed (anycast primer; architecture/BPF 2019; Unimog 2020). Cross-link: `/architectures/apis-edge/` for general edge termination patterns — Cloudflare’s multi-service-every-server edge is a published differentiation theme, not a claim about all CDNs.
Visual walkthrough
Cloudflare announces the same anycast service IPs from many cities. BGP chooses a nearby PoP for performance and naturally distributes attack traffic.
Packets hit the PoP router; ECMP spreads a VIP across many edge servers (≥16 cited in the architecture post).
Cloudflare publishes an open peering policy for AS13335: PeeringDB required, BCP-38 / IRR filtering expected, public IX via the peering portal, PNI when traffic thresholds motivate it.
Control vs data plane
Control plane
BGP announces the same service IPs from many cities; withdrawing a datacenter fails traffic over via anycast. In-PoP, Unimog steers to the correct machine after XDP drops. Traffic Manager / route-shifting posts exist for capacity themes — cite those specifically when asserting TE; do not invent a B4-like WAN controller.
Data plane
Published in-PoP path: packets hit the PoP router; ECMP spreads a VIP across many servers (≥16 cited in the architecture post); XDP/eBPF runs l4drop then Unimog L4 LB/forwarding; Linux dispatches by port/service (e.g. DNS :53).
Request / packet path
North–south
Client → anycast VIP → nearby Cloudflare PoP → Unimog-selected edge server → origin (for proxied HTTP) or authoritative answer (DNS). Peering/PNI at mutual locations per open peering policy.
East–west
Inter-PoP steering is primarily anycast/BGP withdrawal, not a published private-WAN TE paper. Backbone wavelengths, TE controller, and non-edge “core” analytics fabrics are known unknowns.
Scaling & math
Peering policy cites living marketing footprints (cities/countries) — re-verify; do not freeze as forever inventory. Myriagon’s 10,000 connected networks is a historical milestone post. Exact current PoP counts age on the policy page.
When it breaks
- Users pin to a farther city after a PoP is withdrawn.
Cause. BGP withdraw of anycast prefixes for a stressed/failed datacenter.
Mitigation. Anycast failover is the published inter-PoP recovery theme; do not invent unpublished TE schedules.
- Volumetric L3/L4 attack absorbed at edge servers before Unimog.
Cause. Attack traffic arrives on anycast VIPs; l4drop/XDP filters early.
Mitigation. Architecture post: XDP l4drop before Unimog — treat DoS filtering as in-PoP first stage.
- VIP reaches PoP but wrong/unhealthy machine handles the flow.
Cause. Unimog L4 selection or health inputs stale.
Mitigation. Unimog is the published edge load balancer; debug in-PoP LB health, not invented WAN paths.
- Uneven load across edge servers sharing a VIP.
Cause. ECMP hash skew across ≥16 servers (architecture-post theme).
Mitigation. Expect ECMP spreading of VIP traffic; Unimog still selects the correct service machine.
- Public IX peering insufficient for growing bilateral traffic.
Cause. Traffic exceeds policy thresholds that motivate PNI requests.
Mitigation. Follow peering policy (open peering, PeeringDB, PNI thresholds) — no invented metro matrices.
Misconceptions
- “Cloudflare has published a Google-B4-style private WAN TE paper.” — Edge anycast + in-PoP Unimog are thick; backbone TE internals are unknowns.
- “Peering policy city counts are frozen forever.” — Living marketing numbers age; treat as re-verify / known unknowns.
- “Every CDN runs CDN+DNS+WAF on every edge server.” — Cloudflare publishes that multi-service edge pattern; do not generalize unlabeled.
Reference expression
Primary: anycast primer 2011; architecture/BPF 2019; Unimog 2020; peering policy; Myriagon 2021. review: draft. Thick edge path; thin invented WAN.
Standards & sources
- cloudflare-anycast-primer-2011 · Anycast rationalePrimary source, retrieved 2026-09-20. A Brief Primer on AnycastA Brief Primer on Anycast — Anycast rationale
- cloudflare-architecture-bpf-2019 · In-PoP ECMP + XDP pathPrimary source, retrieved 2026-09-20. Cloudflare architecture and how BPF eats the worldCloudflare architecture and how BPF eats the world — In-PoP ECMP + XDP path
- cloudflare-unimog-2020 · Unimog edge load balancerPrimary source, retrieved 2026-09-20. Unimog — Cloudflare's edge load balancerUnimog — Cloudflare's edge load balancer — Unimog edge load balancer
- cloudflare-peering-policy · AS13335 open peering policyPrimary source, retrieved 2026-09-20. Cloudflare Peering PolicyCloudflare Peering Policy — AS13335 open peering policy
- cloudflare-myriagon · 10k connected networks milestonePrimary source, retrieved 2026-09-20. Project Myriagon: Cloudflare Passes 10,000 Connected NetworksProject Myriagon: Cloudflare Passes 10,000 Connected Networks — 10k connected networks milestone
Known unknowns
- Detailed backbone / private transport topology between Cloudflare PoPs (wavelengths, TE controller).
- Exact current city/PoP counts — peering policy marketing numbers age.
- Per-metro capacity and full peering graphs beyond policy thresholds.
- Non-edge “core” datacenter fabrics for control plane / analytics.
- Whether Magic Transit / Spectrum share identical in-PoP paths with CDN HTTP without product-specific citations.
Check yourself
Cloudflare’s published inter-city steering for service IPs is primarily…
- DNS-only without BGP
- Anycast: same IPs announced from many cities via BGP
- Invented private WAN TE like B4
- Open Connect BGP AS40027
Answer: Anycast: same IPs announced from many cities via BGP. Anycast primer + architecture posts: multi-city anycast.
Unimog is…
- A satellite ISL protocol
- Cloudflare’s published edge L4 load balancer
- Azure Front Door VIP rings
- Airbnb SpinalTap
Answer: Cloudflare’s published edge L4 load balancer. Unimog 2020 blog: edge load balancer.
In the architecture/BPF post, before Unimog typically runs…
- Only iptables on the origin
- XDP/eBPF l4drop for volumetric L3 DoS filtering
- Service Fabric placement
- Spanner TrueTime
Answer: XDP/eBPF l4drop for volumetric L3 DoS filtering. Published in-PoP path: l4drop then Unimog.
AS13335 appears in Cloudflare materials as…
- An invented teaching ASN
- Cloudflare’s ASN (peering policy / Myriagon)
- Microsoft AS8075
- Starlink PeeringDB-only claim without caveat
Answer: Cloudflare’s ASN (peering policy / Myriagon). Peering policy and Myriagon reference AS13335.
ECMP in the Cloudflare PoP path primarily…
- Replaces anycast entirely
- Spreads a VIP across many edge servers inside the PoP
- Invented WAN wavelengths
- Configures HAProxy via Nerve
Answer: Spreads a VIP across many edge servers inside the PoP. Architecture post: ECMP across ≥16 servers.
Project Myriagon’s “10,000 connected networks” is…
- A 2026 live inventory to freeze forever
- A historical milestone engineering post
- Proof of backbone TE internals
- An FCC Gen2 satellite count
Answer: A historical milestone engineering post. Treat milestone posts as era-labeled.
What is intentionally thin on this lens?
- Anycast rationale
- Private backbone / WAN TE between PoPs
- Unimog’s role
- l4drop before Unimog
Answer: Private backbone / WAN TE between PoPs. Ship rule: no invented WAN; backbone is known unknown.
Magic Transit / Spectrum specifics should be…
- Assumed identical to the CDN HTTP path without citations
- Cited from their own posts when asserted — not assumed identical
- Invented from PeeringDB alone
- Copied from Azure Cascara
Answer: Cited from their own posts when asserted — not assumed identical. Research known unknowns: do not assume product paths identical.