EN
Back to the archive

The encyclopedia · Software & IT · Technical decision · 2010–2013

Cloudflare ran a global CDN on anycast, so a whole data center can vanish unnoticed

Cloudflare announces every public IP from all its data centers; routing sends traffic to the nearest and fails over automatically when one dies.

Cloudflare

The solution

Cloudflare's business was protecting and accelerating websites from edge servers, which meant every request had to reach a healthy server quickly — and attackers were trying to knock that path out. Traditional setups put load balancers in front of server pools, adding a single point of failure.

Its 2013 architecture post explained the alternative: anycast. All 23 data centers announced the same public IPs; packets simply follow the shortest path, so a London user hits London and a San Francisco user hits San Jose. If a route is withdrawn — process crash, server crash, switch crash, even an entire facility — traffic flows to the next-closest data center automatically.

Cloudflare had to engineer TCP to work across anycast without connection flapping, but the payoff was a network with no single points of failure, able to absorb large DDoS attacks and designed so that more than half of it could fail and still serve traffic.

Why it worked

  • Routing picks the nearest copy, so users get low latency automatically.
  • Failover is a BGP route change, not an application-level decision.
  • Capacity is pooled: attacks spread across every data center at once.
  • No load balancer hardware becomes a bottleneck or a target.
What it achievedMake every location the same addressclever

What can be applied

Let the network do the load balancing: if you replicate the same address everywhere, routing chooses the best copy and failure handling becomes a routing event, not an application problem.

Aftermath

Anycast became the standard architecture for DNS and CDN providers, and Cloudflare grew from 23 data centers in 2013 to a network spanning hundreds of cities that carries a large share of the internet's traffic — all still addressed by anycast.

Sources

spotted an error? The archive wants to know.

Related cases