NetFlows

NetFlows

Last updated Apr 20, 2026 shows network traffic data from end users collected from Cloudflare's edge routers. NetFlows' data also feeds the Internet traffic change ↗︎ chart.

NetFlows includes all types of traffic from Cloudflare's routers, not just traffic to websites served by Cloudflare's CDN ↗︎.

List of endpoints

Timeseries

Example: filtering by product

Besides comparing time series across locations or date ranges (discussed in Make comparisons), we can also examine ALL traffic versus only HTTP traffic using the product filter. For more information, refer to the API reference for this endpoint.

NetFlow products

HTTP traffic only includes web traffic to Cloudflare's zones, while ALL also includes traffic to all other services, like Spectrum, Magic Transit, 1.1.1.1, and others.

In the following example, we will examine both ALL and HTTP traffic in two autonomous systems ↗︎. First, we will examine AS3243 ↗︎, a Portuguese local Internet Service Provider (ISP). The parameters for all traffic are name=AS3243_all&product=ALL&dateRange=1d&asn=3243, and for just the HTTP traffic are name=AS3243_http&product=HTTP&dateRange=1d&asn=3243):

curl "https://api.cloudflare.com/client/v4/radar/netflows/timeseries?name=meo_all&product=ALL&dateRange=1d&asn=3243&name=meo_http&product=HTTP&dateRange=1d&asn=3243&format=json&aggInterval=1h" \
--header "Authorization: Bearer <API_TOKEN>"

This is the abbreviated response:

{
  "success": true,
  "errors": [],
  "result": {
        "AS3243_all": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.565885", "0.586434", "..."]
        },
        "AS3243_http": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.548564", "0.568329", "..."]
        }
    }
}

HTTP traffic values are similar to ALL traffic values. This means that most traffic Cloudflare receives from this AS is traffic to websites served by Cloudflare's CDN ↗︎ product.

In this other example, we will examine AS174 ↗︎, another autonomous system that is not an ISP:

curl "https://api.cloudflare.com/client/v4/radar/netflows/timeseries?name=AS174_all&product=ALL&dateRange=1d&asn=174&name=AS174_http&product=HTTP&dateRange=1d&asn=174&format=json&aggInterval=1h" \
--header "Authorization: Bearer <API_TOKEN>"

The abbreviated response is:

{
  "success": true,
  "errors": [],
  "result": {
        "AS174_all": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.917348", "1.0", "..."]
        },
        "AS174_http": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.381777", "0.408091", "..."]
        }
    }
}

Here, there is less HTTP traffic compared to other types of traffic — which makes sense, since this is not an ISP serving end-users.

Note that here we made two separate requests since we are only interested in whether HTTP comprises the majority of the traffic in each AS or not. If we wanted to actually compare the traffic values between them to, for example, examine who has more traffic, we would have to make a single request including all series. Here is how we could do that:

curl "https://api.cloudflare.com/client/v4/radar/netflows/timeseries?name=AS174_all&product=ALL&dateRange=1d&asn=174&name=AS174_http&product=HTTP&dateRange=1d&asn=174&name=AS3243_all&product=ALL&dateRange=1d&asn=3243&name=AS3243_http&product=HTTP&dateRange=1d&asn=3243&format=json&aggInterval=1h" \
--header "Authorization: Bearer <API_TOKEN>"

which would lead to a response like this:

{
  "success": true,
  "errors": [],
  "result": {
        "AS174_all": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.917348", "1.0", "..."]
        },
        "AS174_http": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.381777", "0.408091", "..."]
        },
        "AS3243_all": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.317136", "0.328652", "..."]
        },
        "AS3243_http": {
            "timestamps": ["2022-11-08T14:00:00Z", "2022-11-08T15:00:00Z", "..."],
            "values": ["0.307429", "0.318505", "..."]
        }
    }
}

This response shows how Cloudflare receives more traffic from AS174 than from AS3243.

Next steps

Refer to HTTP requests for more information about requests from end users.

Was this helpful?

YesNo

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/radar/investigate/netflows/#page","headline":"NetFlows","description":"Query Cloudflare Radar NetFlows data to analyze network traffic from edge routers, including filtering by product and autonomous system.","url":"https://developers.cloudflare.com/radar/investigate/netflows/","inLanguage":"en","image":"https://developers.cloudflare.com/radar/investigate/netflows/og.png?v=c08377a84490b172","dateModified":"2026-04-20","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Examine network layer DDoS attack trends in Cloudflare Radar, broken down by protocol (TCP, UDP, ICMP) and source location. title: Network layer attacks image: https://developers.cloudflare.com/radar/investigate/network-layer-attacks/og.png?v=bbe8d22d76069264

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/radar/llms.txt
Use this file to discover all available pages before exploring further.

NetFlows

NetFlows

List of endpoints

Timeseries

Example: filtering by product

Next steps

On this page