How we deploy rule changes to every edge in under 30 seconds (part 2)
how we deploy rule changes to every edge in under 30 seconds sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under…
Engineering
How we test WAF rules against seven days of real traffic (part 2)
Here is a question we could not answer well a year ago: what really happens with how we test WAF rules against seven days of real traffic? We can answer it now.The…
Connection pooling to the origin: the numbers that surprised us (part 2)
connection pooling to the origin: the numbers that surprised us sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Lessons for…
Connection pooling to the origin: the numbers that surprised us
This post is about connection pooling to the origin: the numbers that surprised us. It started, as most of our posts do, with an incident that did not go the way we…
QUIC and HTTP/3 at the edge: what changes for DDoS mitigation
This post is about qUIC and HTTP/3 at the edge: what changes for DDoS mitigation. It started, as most of our posts do, with an incident that did not go the way…
Zero-downtime certificate rotation at the edge
zero-downtime certificate rotation at the edge sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Measuring successWe track three numbers for…
The hidden cost of retries during a flood (part 4)
Over the last few months we have spent a lot of time on the hidden cost of retries during a flood. This is what we learned.Latency budgetOur budget for the whole filtering…
QUIC and HTTP/3 at the edge: what changes for DDoS mitigation (part 3)
We get asked about qUIC and HTTP/3 at the edge: what changes for DDoS mitigation more than almost anything else, so here is the long answer.The economics behind itA booter service rents…
Why we wrote our proxy data plane in Rust
why we wrote our proxy data plane in Rust sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.What we changedWe…
How we deploy rule changes to every edge in under 30 seconds (part 3)
how we deploy rule changes to every edge in under 30 seconds sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under…
HTTP/2 rapid reset one year later (part 2)
Over the last few months we have spent a lot of time on hTTP/2 rapid reset one year later. This is what we learned.Testing in production, safelyEvery rule starts in log mode.…
Dropping 800 million packets per second with XDP (part 2)
dropping 800 million packets per second with XDP sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Testing in production, safelyEvery…