500 Tbps of Capacity: The Story of 16 Years Expanding a Global Network

Cloudflare has surpassed external interconnection capacity of 500 Tbps. This is not peak traffic, but the total provisioned capacity combining transit providers, private peering, Internet exchange, and Cloudflare Network Interconnect (CNI) ports across every city, with a significant portion reserved as DDoS defense headroom.

Starting in 2010 from a small office in Palo Alto with nLayer Communications as its first transit provider, the company continued expanding city by city through Chicago, Ashburn, San Jose, Amsterdam, Tokyo, and more. Today its network spans 330+ cities and 125+ countries, protecting 20%+ of the web.

As the network grew, Cloudflare became not just a cache but a security layer. It offered features like Magic Transit, which replaces MPLS circuits and protects private subnets, and in 2025 it blocked a 31.4 Tbps DDoS attack in just 35 seconds. That attack originated from the Aisuru-Kimwolf botnet, but it ended without paging any engineers.

Attack response runs on distributed, per-server logic:

• Packets arriving at the NIC are first evaluated by a chain of XDP programs and l4drop eBPF rules.
• Rules are generated by dosd and broadcast across the entire colo.
• The same mitigation decisions propagate to every server worldwide within seconds via Quicksilver.
• Only after that does Unimog distribute traffic, with flowtrackd handling stateful TCP inspection for Magic Transit traffic.

This architecture has also extended into the developer platform. With Containers added in 2025 alongside Workers, KV, and Durable Objects, customer code now runs on the same servers in cities around the world. V8 isolates and a custom filesystem layer reduce cold starts, while attack traffic is blocked before it ever reaches the application stack.

In routing security, Cloudflare is pushing IPv6, RPKI, and ASPA. Cloudflare rejects RPKI-invalid routes, and it notes that 867,000 prefixes in the global routing table currently hold valid RPKI certificates. ASPA is presented as the next step, validating the route itself rather than just prefix ownership.

AI crawlers and autonomous agents are also a new variable for the network. They now account for over 4% of all HTML requests, and so-called user-action crawling grew 15x in 2025. Cloudflare combines verified bot IP ranges, TLS fingerprinting, behavioral analysis, and robots.txt compliance signals to distinguish legitimate crawling from attacks, letting site operators decide for themselves whether to allow a given crawler.

Sixteen years of accumulated work boil down to a single number. 500 Tbps isn't just bandwidth — it's the result of distributing security, a development platform, routing policy, and automated defense across the edge worldwide.