Netflows

Netflows Open external link shows network traffic data from end users collected from Cloudflare’s edge routers. Netflows’ data also feeds the Internet traffic change Open external link chart.

Netflows includes all types of traffic from Cloudflare’s routers, not just traffic to websites served by Cloudflare’s CDN Open external link .

​​ List of endpoints

​​ Timeseries

​​ Example: filtering by product

Besides comparing time series across locations or date ranges (discussed in Make comparisons), we can also examine ALL traffic versus only HTTP traffic using the product filter. For more information, refer to the API reference Open API docs link for this endpoint.

In the following example, we will examine both ALL and HTTP traffic in two autonomous systems Open external link . First, we will examine AS3243 Open external link , a Portuguese local Internet Service Provider (ISP). The parameters for all traffic are name=AS3243_all&product=ALL&dateRange=1d&asn=3243, and for just the HTTP traffic are name=AS3243_http&product=HTTP&dateRange=1d&asn=3243):

curl -X GET "https://api.cloudflare.com/client/v4/radar/netflows/timeseries?name=meo_all&product=ALL&dateRange=1d&asn=3243&name=meo_http&product=HTTP&dateRange=1d&asn=3243&format=json&aggInterval=1h" \
     -H "Authorization: Bearer <API_TOKEN>"

This is the abbreviated response:

"AS3243_all": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.565885", "0.586434", "..."]
},
"AS3243_http": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.548564", "0.568329", "..."]
},

HTTP traffic values are similar to ALL traffic values. This means that most traffic Cloudflare receives from this AS is traffic to websites served by Cloudflare’s CDN Open external link product.

In this other example, we will examine AS174 Open external link , another autonomous system that is not an ISP:

curl -X GET "https://api.cloudflare.com/client/v4/radar/netflows/timeseries?name=AS174_all&product=ALL&dateRange=1d&asn=174&name=AS174_http&product=HTTP&dateRange=1d&asn=174&format=json&aggInterval=1h" \
     -H "Authorization: Bearer <API_TOKEN>"

The abbreviated response is:

"AS174_all": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.917348", "1.0", "..."]
},
"AS174_http": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.381777", "0.408091", "..."]
}

Here, there is less HTTP traffic compared to other types of traffic — which makes sense, since this is not an ISP serving end-users.

Note that here we made two separate requests since we are only interested in whether HTTP comprises the majority of the traffic in each AS or not. If we wanted to actually compare the traffic values between them to, for example, examine who has more traffic, we would have to make a single request including all series. Here is how we could do that:

curl -X GET "https://api.cloudflare.com/client/v4/radar/netflows/timeseries?name=AS174_all&product=ALL&dateRange=1d&asn=174&name=AS174_http&product=HTTP&dateRange=1d&asn=174&name=AS3243_all&product=ALL&dateRange=1d&asn=3243&name=AS3243_http&product=HTTP&dateRange=1d&asn=3243&format=json&aggInterval=1h" \
     -H "Authorization: Bearer <API_TOKEN>"

which would lead to a response like this:

"AS174_all": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.917348", "1.0", "..."]
},
"AS174_http": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.381777", "0.408091", "..."]
},
"AS3243_all": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.317136", "0.328652", "..."]
},
"AS3243_http": {
  "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
  "values": ["0.307429", "0.318505", "..."]
}

This response shows how Cloudflare receives more traffic from AS174 than from AS3243.

​​ Next steps

Refer to HTTP requests for more information about requests from end users.