network · deep · draft
Edge / CDN request path
A comparison of published edge request paths — Cloudflare anycast + Unimog, Fastly PoP/routing docs, Netflix Open Connect BGP-informed steering, and AWS CloudFront delivery — not an invented “generic CDN” topology.
In one sentence. Engineers often draw one unlabeled CDN box. Real public designs differ: anycast multi-service edges, DNS/PoP routing products, embedded ISP caches with BGP prefix steering, and managed CloudFront-style distribution each publish different control vs byte planes.
Why it exists
Do not invent a generic CDN. Compare primaries: Cloudflare anycast edge with in-PoP ECMP → XDP l4drop → Unimog (`/architectures/cloudflare/`); Fastly PoP + routing-traffic docs and Autopilot/CPR research; Netflix Open Connect split control plane in AWS vs OCA bytes (`/architectures/netflix/`); AWS CloudFront how-it-works / features (`/architectures/amazon-aws/`). Cross-link `/architectures/apis-edge/` for API termination vs byte delivery, and `/architectures/anycast-traffic-steering/` for steering-mechanism contrast.
Visual walkthrough
Same service IPs announced from many cities; BGP delivers the client to a nearby PoP. Not a claim about every CDN.
Player talks to Playback Apps for auth/licensing; Steering returns ranked OCA URLs. Control plane ≠ byte plane.
CloudFront teaching path: viewer hits an edge location; cache hit serves locally; miss fetches origin per AWS how-it-works.
Control vs data plane
Control plane
Cloudflare: BGP anycast announcements + in-PoP Unimog health. Netflix: Playback Apps / Steering / cache-control in AWS ranking OCA URLs from health, BGP prefixes, title availability. Fastly: published routing-to-Fastly and Autopilot/CPR themes for path intelligence — cite those docs, not invented controllers. CloudFront: AWS distribution configuration (origins, behaviors, edge locations as product surface). Exact multi-CDN orchestration for unnamed companies is unknown.
Data plane
Cloudflare: client → anycast VIP → nearby PoP → Unimog-selected server → origin (proxied) or local service. Netflix: client fetches HTTP/HTTPS bytes from steered OCA URLs — not from Playback Apps hosts; embedded OCAs serve only BGP-announced customer prefixes. CloudFront: viewer → edge location → (cache hit) or origin fetch per AWS docs. Fastly: viewer → PoP per routing docs — do not invent unpublished backbone TE.
Request / packet path
North–south
Viewer/player → edge/PoP/OCA → origin or encoded media. Whether the first hop is anycast IP, DNS/product routing, or control-plane URL steering is the published differentiator — walkthroughs compare them side by side.
East–west
Inter-PoP failover: Cloudflare emphasizes anycast/BGP withdraw; Netflix prefers embedded AS40027 short path vs PoP peering AS2906 backup/fill; CloudFront/Fastly publish product edge maps and routing concepts without claiming identical TE. Corporate fabrics behind edges remain company-lens known unknowns.
Scaling & math
Peering policy and marketing footprints age — re-verify living numbers. Open Connect preference rules are qualitative (embedded preferred when prefix heard). CloudFront/Fastly do not publish a universal hit-ratio formula usable as capacity planning here. No invented PoP inventories.
When it breaks
- Users pin to a farther Cloudflare city after PoP withdraw.
Cause. BGP withdraw of anycast prefixes for a stressed/failed datacenter.
Mitigation. Treat anycast failover as the published inter-PoP recovery theme — see Cloudflare lens.
- Players get poor OCA choices; quality drops despite healthy byte caches.
Cause. Steering/cache-control inputs stale or control-plane outage.
Mitigation. Separate control SLOs from byte-delivery SLOs on the Open Connect split plane.
- ISP customers miss embedded OCAs and fall back to PoP/peering.
Cause. ISP did not announce customer prefixes to the embedded OCA over BGP.
Mitigation. Verify BGP announcements per Open Connect network-configuration docs.
- CloudFront/Fastly-class miss path fetches origin; latency rises.
Cause. Cache miss or behavior/origin misconfiguration on the product path.
Mitigation. Debug distribution behaviors/origins per CloudFront docs; do not invent hit ratios.
- Edge connection quality degrades until path reselection recovers.
Cause. Poor first-path choice or changing underlay conditions at the edge.
Mitigation. Fastly CPR/Autopilot publish connection path reselection research — cite papers, not invented TE.
Misconceptions
- “Every CDN is global anycast like Cloudflare.” — Netflix publishes BGP-informed steering + URL selection; CloudFront is an AWS product path.
- “Playback/API hosts serve the video bytes.” — Open Connect: Steering returns OCA URLs; clients fetch bytes from appliances.
- “One generic CDN diagram covers Cloudflare, Fastly, Netflix, and CloudFront.” — Compare published patterns; do not invent a mash-up topology.
Reference expression
Primary: Cloudflare anycast primer, architecture/BPF, Unimog; Fastly PoP docs, routing-traffic, Autopilot, CPR NSDI; Netflix Open Connect Overview + network config; AWS CloudFront how-it-works + features. review: draft. When to choose which teaching lens: anycast multi-service edge (Cloudflare), BGP-informed embedded cache (Netflix), managed distribution product (CloudFront), research-grade PoP path reselection (Fastly CPR/Autopilot). When not: draw one unlabeled “CDN” and assert it matches all four.
Standards & sources
- cloudflare-anycast-primer-2011 · Anycast edge rationalePrimary source, retrieved 2026-09-20. A Brief Primer on AnycastA Brief Primer on Anycast — Anycast edge rationale
- cloudflare-architecture-bpf-2019 · In-PoP ECMP + XDP pathPrimary source, retrieved 2026-09-20. Cloudflare architecture and how BPF eats the worldCloudflare architecture and how BPF eats the world — In-PoP ECMP + XDP path
- cloudflare-unimog-2020 · Unimog edge L4 LBPrimary source, retrieved 2026-09-20. Unimog — Cloudflare's edge load balancerUnimog — Cloudflare's edge load balancer — Unimog edge L4 LB
- fastly-pop-docs · Fastly PoP conceptsPrimary source, retrieved 2026-09-20. Using Fastly's global POP networkUsing Fastly's global POP network — Fastly PoP concepts
- fastly-routing-traffic · Routing traffic to FastlyPrimary source, retrieved 2026-09-20. Routing traffic to FastlyRouting traffic to Fastly — Routing traffic to Fastly
- fastly-cpr-nsdi-2021 · Edge path reselectionPrimary source, retrieved 2026-09-20. Staying Alive: Connection Path Reselection at the EdgeStaying Alive: Connection Path Reselection at the Edge — Edge path reselection
- fastly-autopilot-blog · Autopilot smart network themesPrimary source, retrieved 2026-09-20. Turning a Fast Network into a Smart Network with AutopilotTurning a Fast Network into a Smart Network with Autopilot — Autopilot smart network themes
- netflix-open-connect-overview · Control plane vs OCA bytesPrimary source, retrieved 2026-09-20. Netflix Open Connect OverviewNetflix Open Connect Overview — Control plane vs OCA bytes
- netflix-open-connect-network-config · BGP prefix steering inputsPrimary source, retrieved 2026-09-20. Network configuration (Open Connect BGP/ASN)Network configuration (Open Connect BGP/ASN) — BGP prefix steering inputs
- aws-cloudfront-how-it-works · CloudFront delivery pathPrimary source, retrieved 2026-09-20. How CloudFront delivers contentHow CloudFront delivers content — CloudFront delivery path
- aws-cloudfront-features · CloudFront global edge product surfacePrimary source, retrieved 2026-09-20. Amazon CloudFront features (global edge network)Amazon CloudFront features (global edge network) — CloudFront global edge product surface
Known unknowns
- Living PoP/city marketing counts age — re-verify; not frozen inventory.
- Hit ratios, fill schedules, and unpublished backbone TE are not asserted.
- Multi-CDN orchestration policies for unnamed enterprises are unknown.
Check yourself
Cloudflare’s published inter-city steering for service IPs is primarily…
- DNS-only without BGP
- Anycast: same IPs announced from many cities
- Open Connect AS40027 only
- Invented private WAN TE
Answer: Anycast: same IPs announced from many cities. Cloudflare anycast primer / architecture posts.
After Netflix Steering returns OCA URLs, video bytes come from…
- Playback Apps hosts in AWS
- Open Connect appliances over HTTP/HTTPS
- Only CloudFront distributions
- Unimog alone
Answer: Open Connect appliances over HTTP/HTTPS. Open Connect Overview split plane.
Embedded OCAs serve client IPs when…
- Any global anycast VIP matches
- The ISP announces those customer prefixes to the OCA over BGP
- STP converges
- OMP assigns a TLOC color
Answer: The ISP announces those customer prefixes to the OCA over BGP. Open Connect network configuration.
AWS CloudFront’s published teaching path is…
- Invented Netflix corporate Clos
- Viewer → edge location → cache hit or origin fetch (product docs)
- Only SGT microseg
- Only Fastly Faild
Answer: Viewer → edge location → cache hit or origin fetch (product docs). CloudFront how-it-works.
Why avoid a single unlabeled “generic CDN” diagram here?
- Because SPEC forbids teaching edges
- Published patterns differ (anycast vs BGP steering vs product distribution) — inventing a mash-up is dishonest
- Because only Azure Front Door exists
- Because CDNs never use HTTP
Answer: Published patterns differ (anycast vs BGP steering vs product distribution) — inventing a mash-up is dishonest. Phase 8 ship rule: compare primaries; no invented generic CDN.
Fastly CPR (NSDI 2021) is primary evidence for…
- Cisco OMP
- Connection path reselection at the edge
- EVPN Type-5 only
- Starlink ISL TE
Answer: Connection path reselection at the edge. CPR paper title/theme.
Cloudflare in-PoP path after ECMP includes…
- XDP l4drop then Unimog L4 LB
- Only MPLS L3VPN
- Only ISE SGT
- Only Direct Connect gateways
Answer: XDP l4drop then Unimog L4 LB. Architecture/BPF + Unimog posts.
When is CloudFront the better teaching lens than Open Connect?
- When explaining embedded ISP BGP prefix steering for Netflix appliances
- When explaining a managed AWS distribution product path (behaviors, origins, edge locations)
- When teaching Unimog XDP
- When teaching Catalyst SD-WAN VPN 0
Answer: When explaining a managed AWS distribution product path (behaviors, origins, edge locations). When-to-choose among published patterns.