Name: The DDoS Threat is Real — Is Your Network Ready?
Uploaded: 2025-06-12T11:15:03.626Z
Duration: 1 h 45 min
Description: The DDoS Threat is Real — Is Your Network Ready?

Transcript for "The DDoS Threat is Real — Is Your Network Ready?": At Cloudflare, we have seen an increase in cyberattacks, most notably distributed denial of service or DDoS attacks. DDoS attacks are bad for business. They can halt business operations, frustrate customers and employees, and lead to lost revenue. To make matters worse, they can also impair your team's ability to communicate and remediate. DDoS attacks are increasing in volume, frequency, and sophistication. Is your organization prepared? Read our latest report to stay up to date with the most current attack trends and learn how Cloudflare can help protect your network. Good afternoon. Welcome to our live webinar. My name is Eric Tso from Cloudflare marketing team. Before we get started today, here are some quick housekeeping notes. on the right side of of your screen, you will see a q and a box. Please feel free to submit any questions at any time during session. Our speakers will address your questions at the end of our webinar. in the document box, you will find the links to our Cloudflare radar and some other reports. This content can help you better understand today's topic. Now please join me in welcoming our speaker. Good afternoon, Jeremy. Hey, Hadek. Over to you. Okay. Thank you. Thank you, Eric. Good afternoon, everyone, and a very warm welcome to our webinar on the Hadoop's tech, which is real easy network ready. I'm Hitesh Partak, head of solutions engineering South Korea India, and I'm thrilled to be your host for today as we dive into the topic that is becoming increasingly critical for our businesses of all sizes, especially here in India. Just to set the context, you know, before I go on with the topic, I will give you some some background about why we are doing this webinar today. In today's digital landscape, the threat of, DDoS attack like, distributed denial service is not just theoretical. It is very real and a growing concern. We are experiencing a significant rise in the frequency, sophistication, and scale of user tags. It is just about it is just isn't about inconvenience, but also a successful deal of attack can bring down your operations, severely impact your revenue, and, you know, also could lead to a loss of customer trust. Here in India, with our rapid, digital transformation and increasing reliance on the services which are online, right, we are seeing a a parallel rise in cyber threats. Not just that, even the government agencies like CERTAIN are consistently issuing advisories, urging organizations to significantly, you know, increase their cybersecurity posture. By the way, this isn't just a suggestion. It's a I would say it is a clear directive driven by the evolving threats, and the landscape. Right? In today's session, we'll be exploring how Cloudflare's comprehensive security portfolio can act as your frontline defense against these, relentless attacks. We have an incredible line of speakers today who are experts in this field, and they'll be diving deep into the technical aspects and the practical applications. Right? Without further ado, let's get started. Please join me in welcoming our speaker, Omar Yachemic. Omar, over to you. Thank you, Hitesh. Good afternoon, everyone. Thanks for joining us. So, my name is Omer. I'm, I oversee, Cloudflare's DDoS protection services, here at Cloudflare. And, we have, an a nice agenda for you today. So we're gonna start with the basics with, what is a DDoS attack. I'm not gonna stay there too long. If anyone has any specific questions, then, then please, send them in the chat or in the QA. Then we'll, kind of dive deep into the threat landscape as we observed from the Cloudflare edge, then a little focus on India and some of the attack trends that we've recently seen, an overview of our DDoS protection, and, how that ties into the best practices. And then we'll hand it over to Alyona, to kind of give us an overview of the magic transit, solution, our layer three, service for protecting, networks and, of of course, QA after that. So without further ado, let's let's dive in. So a DDoS attack, is basically one of the oldest types of cyberattacks. Right? So it's a low cost, high impact method. Launching an attack is very cheap, and if it is successful in disrupting or taking down a website or some Internet service, the cost can be highly, highly, great. So the barrier of entry also for launching an attack is also really low. A threat actor and in the rise of, threat actors that, don't have any prior knowledge that can just leverage DDoS for higher services, or even, generative AI services in order to, to to create a script to launch attacks, it's very easy. All you need is the, website address, the URL that you want to attack, or even, just the IP, and then, you can easily launch the attack. And according to The US, CISA, there are three categories of attacks. Even though they're not mutually exclusive, there is some overlap. But there is but this is kind of their attempt of categorizing attacks, and I've borrowed their categorization. So we have the volumetric attacks, that aim to consume available bandwidth. Then we have protocol attacks that are, that exploit the stateful protocols and other vulnerabilities and network and application protocols. And finally, we have application layer attacks that target the application layer. These tend to be more sophisticated attacks. And you can see the analogies, that, for each one of these, attack types. And each one of these attack types can be launched in various methods as a flood, as a reflection off of party vulnerable serve servers on the Internet. And if the payload that is reflected is larger than what was sent, then that's what we call an amplification attack. Another type of a DDoS attack is a low and slow where you were slowly consuming, the resources of a server, for example, in order to exhaust their resources to deny legitimate users access. And all of these can be, of course, provided with a, a ransom note or ransom demand, which we've kind of seen go up and down over the past quarters. So with that in mind, let's, dive into the threat landscape. So, 2025 started really, with a bang. So we saw a massive 358% increase, year over year increase in DDoS attacks. We mitigated in the first quarter alone 20,500,000 DDoS attacks. And for comparison, in the entire year of 2024, we mitigated 21,300,000 DDoS attacks. So just in the beginning of the year, we already mitigated 96% of what we mitigated the entire last year. Now the that that averages to 9,490 DDoS attacks that our systems detected and mitigated autonomously every hour. Now when we look at where the attacks come from, and this combines, layer three, four attacks that target the network and layer seven attacks that target the application, we can see that Hong Kong, Indonesia, and Argentina were the top three largest sources of DDoS attacks. And now there's a clarification here that's needed that this doesn't mean that these attacks launch the, that these countries launch the attacks, but rather that there are botnet nodes operating from within those, locations. And, it could also mean that there are VPN or proxy endpoints that threat actors use to, obfuscate their source. And it could also mean for layer three four attacks that this is the location of the Cloudflare data center where we ingested the attack packets. We use the Cloudflare data center location to map the distribution of, attacks by location for layer three four attacks because, IPs can be spoofed at that layer. Right? And so, because we have presence in over 330 city around, around the world, we have geographical we can generate geographical accuracy by using the location of our data centers. And if you're wondering where India fits in this list, India was the 40 largest source of DDoS attacks worldwide. Now when we think about the attacks, and their sizes, most of the attacks are small. So 99% of, layer three four attacks, were under one gigabit per second and under 1,000,000 packet per second. But even that can easily, kind of take down unprotected websites that don't have that capacity. If you have a one gigabit per second link and you have peak traffic coming through and now you have a one gigabit per second attack, that's just gonna cause saturation. Your ISP is gonna, basically, deny service cause the denial of service event because your Internet link will be saturated. Similarly, 94% of HTTP attacks were under 1,000,000 requests per second, and around 90% of the attacks and 70% seventy five percent of the attacks were also very short, under ten minutes. But what we do see is a rise in large volumetric attacks, what we call the hyper volumetric attacks. So in q one, six out of every 100 HTTP attacks exceeded 1,000,000 requests per second. That's quite a lot. And for layer three four attacks, four out of every 100,000 attacks exceeded one terabit per second. And the this trend of hyper volumetric attacks exceeding one, two, three, four, and, more recently, even six and higher terabits per second and 4,000,000,000 packets per second has become very common. We've seen this start in, q three of twenty twenty four, and this has continued continued into 2025. You can see this scatter map here. We're averaging at eight hyper volumetric attacks every day. That's quite a lot. And, as one one of these attacks that we mitigated, the largest one from the packet perspective, was a 4,800,000,000 packet per attack. It lasted only thirty five seconds, and it was automatically, detected and mitigated by our systems, causing no incidents, no performance degradation, no, alerts being fired and all hands on deck, nothing like that. It was mitigated autonomously, originated from about 147 countries around the world, and targeted multiple IPs and ports of a hosting provider that is protected by Cloudflare Magic Transit. Magic Transit, again, is the service that the service that Alyona will dive in deeper, into, the in in the next, section. Also, one of the largest attacks that we saw, was a 6.5 terabits per second. And, again, this lasted only forty five seconds. So the concept of using or the the the legacy solutions of on demand, services or relying on some, out of path ISP solution, is just outdated because forty five seconds doesn't leave time for human response. Even if the attack is ten minutes, that doesn't leave sufficient time for a user or for a, you know, for the network engineer or the security engineer to receive the pager duty alert, to log in to their dashboard, see what's happening, and decide on what action to take. By the time there is a human response, and you can see how the attacks ramp within seconds from min to max rates, the attack, is already, hitting with max force. And so I like to give the analogy of a boxing match. So the the impact, the punch can be a fraction of the if your guard is down. But if it hits you just right, then, you know, that's a knockout. Right? And it'll take you a long time to recover for that, and you might lose the, the, the the the match as well. Now when we look at the types of attacks that we see, kind of the attack vectors or the attack methods, in the HTTP world, the, almost 60% of all of the attacks that we mitigated were mitigated using our, as known DDoS botnets. This means that, we are able to leverage the threat intelligence of our systems because we see so much traffic around 20 to 25% of, of all Internet traffic routes through Cloudflare. And so we gain quite a lot of threat intelligence, and that benefits, every customer that uses our platform. Additional, top factors include attacks with suspicious HTTP attributes and attacks that are, pretending to be, you know, a browser, a headless browser, or fake browsers, and generic floods, even, cache busting attacks as well. Now when we look at the layer three four side, those hyper volumetric attacks, most of them are UDP. But, in layer three four, in as a whole, syn floods were the most common attacks. This is something that's been, kind of, syn floods have been the most common attack vector for some, quarters now subsequently. And so that's followed by DNS attack. And DNS attacks can be considered a type of an indirect attack on a HTTP application because if you disrupt the DNS floods, then or the DNS translation process, then you basically render the website unavailable. And in place, we saw Mirai attacks, both TCP and UDP types of attacks from Mirai. Mirai has a bunch of capabilities to launch attacks. And in fact, attacks by Mirai, the, or Mirai variant botnets have increased, in q one by January compared to the previous quarter. Now that massive spike in DDoS attacks that we saw in q one was primarily fueled by an eighteen day campaign of attacks that targeted the Cloudflare's infrastructure directly. So this was a campaign aimed at taking down or disrupting, the Cloudflare network. It involved 6,600,000 DDoS attacks, as you can see here, the daily attacks per day. And this was part of a wider campaign against the Internet infrastructure because we saw an additional 6,900,000 DDoS attacks against hosting providers and Internet service providers, that we protect, with magic transit. Needless to say that these attacks were autonomously mitigated. They were this was a multi vector campaign involving cine floods, Mirai attacks, and even SSDP amplification attacks, just to name a few. Now when we look at, the top attack locations, where, or who the attacks are attacking. And again, it's important to clarify here that these are when we say that a country or location is under attack, that doesn't mean that the country itself, but rather companies, that are located in, or that have a building address of that, country, have, have been attacked. And so we bucket it bucket the attacks by the, building country of our customers in order to kind of gain that global, view. And we can see that in q one. Germany, Turkey, and China were the most attacked were the top three most attacked, countries. And India was number five, jumping four places compared to the previous quarter. And again, this includes layer seven attacks and layer three, four attacks. Now when we look at the most attacked industries, we saw some notable changes in q one. The gaming and gambling industry jumped to the top as the most attacked industry. And following that, we have the telecommunications service providers and carriers, so critical infrastructure that is protected by Cloudflare. And in the previous quarter, they were actually in the place. And then place, again, we have kind of that critical infrastructure, IT and services as well. You can see here the rest of the top 10, including banking and financial services in in the and and the place and so on. Now another way to bucket attacks and look at where they're coming from, is the, source ASN, the source networks that they're coming from. And we see the kind of the regular, top, hosting providers that the that attacks are originating from, such as HetSnail, from Germany, the French OVH, DigitalOcean. But we even see here a kind of the China, backbone, China the China telecom, Tencent, even Microsoft and Google Cloud made made it to the top 10. And, it's a challenge for hosting providers for cloud computing platforms to identify the abuse, the accounts that are generating attacks that are used as botnet nodes. And so a lot of these service providers reached out to us, and we, because for them, this is encrypted traffic. They can't see it. It can be a needle in a haystack. But we see the entire picture, all of the attacks together, all of the IPs. So we're uniquely positioned to help these service providers, these hosting providers to detect where the attacks are coming from and crack down on the abuse. And so we decided to provide a free botnet threat feed that, ASN owners or service providers can use to get a list of their IPs from within their network that we saw participating in DDoS attacks. So far, we've had over 600, organizations sign up to the botnet threat feed, and we've seen active takedowns of abusing accounts thanks to this feed. So, we're hoping that this, free service and you're welcome to scan it, and, and use it, doesn't require you can just open a free Cloudflare account and then just authenticate your network, and start getting the the threat intel via API. So, you're welcome to do that. And using cloud computing providers or cloud hosting platforms, we've seen an increase in attacks coming from them. And this is kind of the, innovation that threat actors use. So think of it like this. Right? So, a a startup or a single a one person show or a small team can create enterprise grade, infinitely scalable and intelligent application using cloud computing providers, that can scale horizontally and, generative AI to write smarter scripts. And then we also, can see the the the flip side of it of malicious start ups. So we see the, era of the knowledge less threat actors that can use generative AI, for example, and their existing knowledge, to leverage those same technologies, whether it's a one person show or whether it's a small team to create very sophisticated botnets that launch very large attacks, and that were like, the the their capabilities that that we're seeing today, the size and sophistication, were previously associated with state level or state sponsored, threat actors. And this is a very, kind of frightening, downside to the rise of, you know, the the, accessibility to these technologies. And these botnets that are built on virtual machines, can be up to 5,000 times stronger than IoT based devices, based botnets. Just think of it like this, a security camera has limited computational power. It has limited bandwidth, and this is compared to a server, a virtual server that you can rent, with who who knows how many, CPUs. So the you can generate a lot more force with a single server. And attacks that previously required millions of IPs, to reach high rates, now we're seeing originating from just a few thousand or a few tens of thousands of IPs. Now another question that we get asked often, who are these threat actors? Who's launching these attacks? Now while most of, our customers that we survey, actually don't know, who attacked them. It's really hard to know if you don't have a, a a threat or ransom note. In many cases, we have customers that reported, that someone threatened them, in the in their discord channel or, in their support channels. And, the top, threat actors reported by Cloudflare customers, in q one were actually competitors. So, that's 39% of the customers, that that didn't know who attacked them. And then surprisingly, 17% said that it was a state level or a state sponsored attack, followed by disgruntled customers or users. 11% actually admitted it was a self DDoS attack. So this is something that, is actually more common than, than you think. For example, we have a large IoT, manufacturer that released a firmware update, And there was, there was, an issue, a bug in the firmware that caused all of the devices to phone home at the same time, causing a self DDoS. So, our systems also pick up those types of kind of legitimate, floods, but unwanted floods of traffic. Then we have extortionists, and followed with, disgruntled employees or former employees. And with that, let's dive in a little and talk about India and the the trends that, that we're that we've seen. So, when we look at the, kind of the share of DDoS attacks, HTTP DDoS attacks, towards, India. We've seen for the beginning of the year overall, despite the kind of, the the the patterns of, up and down, overall a decrease in attack traffic. But then, from April 27 to my third to May 3, we saw a surge in DDoS attacks peaking at 13%. So this means that during this time, over, well, 13% of traffic towards India was attack traffic. That that's, you know, more than one out of every 100 HTTP requests towards Indian, websites. And these mainly targeted, information services, so IT and services, surprisingly also e learning systems, software companies, and also financial services as well. Now when we look at where attacks are coming from, we we see these top five, ASs, which, at least DigitalOcean aligns with the top ASs that we saw globally. And overall, all of the when we look at all of the kind of layer seven attacks towards India, 50% of them were, WAF attacks. So, attacks that are not necessarily volumetric but targeting the application. And then 46% was, DDoS attacks. Another 3% were a variety of various attacks. And overall, in the half of the year, one out of every 100 requests towards India was malicious. Now on the network layer, things have been pretty calm relatively speaking towards, Indian networks, but we did see a relatively, large spike, towards, Indian networks between, on April 20 and April 29. This was mainly, government administration, so government, networks and IP applications. And when we look at the attack vectors used towards India, then syn floods again in the place, like, globally, and, Mirai attacks, UDP specifically, in place, followed by UDP floods, DNS amplification attacks, and so on. So with all of that, taken into consideration, we can summarize the threat landscape, until these five, kind of bullet points. So we're seeing a growth, and consistency in the hyper volumetric attacks. And coinciding with, the rise in generative AI, we're seeing a rise in these ultra sophisticated DDoS attacks. And when I say sophisticated, this means that they are randomized and hard to detect, that they imitate user behavior, and browser behavior properly, and it makes them harder to distinguish between good and bad traffic. Then the bullet point here is, we're seeing an increase in randomized UDP attacks and attacks over the quick protocol. Finally, in and we see recycled DDoS attack methods. That's something that continues like with the Mirai attacks. Mirai is not a new attack tool, and it has quite a distinctive signature that we're able to lock on to. And so the threat actors continue to recycle DDoS attack methods, various amplification, methods. And, finally, the for years now, the the rise in geopolitical driven DDoS attacks that are based on, regional conflicts, elections, events, and, and wars as as well. And now let's take those and tie them to the best practices. So given this threat landscape, what do we recommend for organizations, in order to best position themselves, to be to to be able to sustain and defend and remain available in the face of DDoS attacks. So the thing is to have an inline automated DDoS mitigation system. So, this means, because we saw that attacks can spike from zero to max within seconds, you can't rely on out of path or on demand, mitigation systems. You have to have inline mitigation with a sufficient global coverage and capacity in order to sustain everyone's peak traffic, peak traffic levels, at alongside these hyper volumetric attacks. So we're talking about a cloud service that has automated inline mitigation capabilities. Now the recommendation is to enforce a strict security model. So if there's traffic that you never want in, then block it using firewall rules. If it's if we're talking about layer seven, using, bot management solutions and API, schema validations, and various, configuration as in tools that the platform, provides. Many platform provides various types of configurations and so do we. You get quite a handful of capabilities, and, even a CDN, using a a content caching to, to delegate as much of the content to the edge, is very effective because the less traffic that reaches your origin, the better you are, basically protected or or the the risk is lower, for any type of saturation or overwhelming or exhausting CPU resources. And the recommendation is to have critical alerts set up, and to have access to real time analytics because you wanna be notified when things start, looking bad. You wanna be notified in advance so you could take action to avoid impact. And we've seen a lot of organizations that didn't have any of these and were, had to had to guess had to try and guess what was going on. They didn't know they didn't have the proper alerts. They didn't have access to the dashboard or even any runbooks on what to do, which ties into the recommendation, which is to develop a strategy. There are various frameworks. Some countries, or regions have a, required framework, for various industries, like the financial industry or critical infrastructure, for example, and build a strategy combining these best practices and what is required by regulation. And then have, the tools, the alerts, the protections set up, have the runbooks so your employees know how to respond, and also train your employees so they know what to do, when something happens. It's very important, and even train the nontechnical employees on how to react. I can give an example here where we had a, a an organization reach out to us. They were under a ransom DDoS attack, and, it took them a lot of time to we eventually onboarded them and and and, all of the attacks were mitigated. But beforehand, they didn't have any, protections in place. They they relied on their ISP, but their ISP after working hours kind of just disappeared, on them even though it was still a kind of like a p zero or a p one, incident for them. And the reason that it took them so long to understand what was happening because the the threat actors were sending the ransom emails, demanding, cryptocurrency in exchange for stopping the attacks. And they were sending these emails to publicly, available or scrapable email addresses, like careers@supportat,um,pratand so on. And the administrators of those inboxes just dismissed it as spam, And that cost the security incident response team a lot of time in their response time, until one employee decided to share it with, kind of with the, with the security, incident response team. And then they started putting one and two together and understood that they were under a ransom DDoS attack. So, even training the nontechnical employees can go a long way. So even at the Cloudflare, we train to, report anything that looks suspicious. We will never penalize any employee for reporting something. We want everyone to report as much as possible, in order to stay ahead of any type of threat. Now, I'll quickly go over our DDoS protection, kind of capabilities, and then I'll hand it over to, Alyona to cover Magic Transit. So basically, our mission with our our our DDoS protection services is to make DDoS downtime and disruption the thing of the past. And this is using our autonomous systems, and the and the and all of the granular control and and configuration that our platform provides. And we provide protection kind of across the entire OSI stack for HTTP applications, TCP, UDP applications, and entire networks at, layer three. That's the magic transit that Alyona will cover in a moment. And we use our entire network to provide our services, not a subset of scrubbing centers or dedicated devices, but rather every dot that you see here on the map is, we have a point of presence there. It's a Cloudflare location. And in every one of those, pops, we might have presence in multiple colocations, multiple data centers. And in each one of those, a bunch of Cloudflare servers. And each one of those servers is able to detect and mitigate attacks by itself. This is what we call our autonomous DDoS protection, system, because it is a distributed autonomous system, that doesn't require any centralized regulation. It significantly improves our, mitigation efficacy and also our network's resilience. So our autonomous DDoS protection is built out of three main or includes three main pillars, dynamic fingerprinting, where we, in real time, are able to detect the pattern and the attacks and apply mitigations, adaptive protection, which is based on customer traffic profiling, and and it's infused with our machine learning models, for better accuracy, so to detect anomalies. So if if most of your traffic is coming from India, for example, and then some maybe other countries in the region. And suddenly, there is a spike coming from South America where you don't have, where where you don't operate in or don't expect a lot of users, then that would be flagged and and, mitigated for your configurations. Then lastly, we have our intelligent protection, which involves TCP flow classification and state tracking for those very randomized TCP attacks. And we also have, a relatively new system for, DNS protection. So it's a DNS query profiling mechanism, and that's very efficient against those randomized prefix DNS attacks. In addition to that, we built a real time botnet tracking and scoring system and an anomaly detection system. And those systems together are able to incriminate botnets in real time and increase the mitigation efficacy very quickly. Those have been really effective, in layer seven and also in layer three, four. And these systems, like we've, demonstrated, are battle proven against the largest attacks, whether it's HTTP attacks, or layer three four attacks. And, you know, when we kind of think of who could handle these types of attacks and when we look at the, vendors that offer, DDoS protection services, for for layer three, and layer four, kind of magic transit type of services. We can see that for the majority of the vendors, it would consume, you know, from from a to over 50% of their available capacity, which is insane, the largest attack that is. And with Cloudflare, that would consume less than 2% of our global capacity, and we're able to tap into our global capacity using global anycast. So we leverage all of our capacity and points of presence kind of using the distributed nature of the attacks against it. We have two times more pops, more points of presence, than all of the vendors combined, and we have three times, more capacity than all of the vendors combined, just to give you some, example of the, kind of the the span of of of our network. And, again, don't just take our words for it. You can see what our what analysts have to say. Every analyst every year has ranked Cloudflare, the highest or the leader or receive the highest number of, of ratings and so on ranging from Gartner, IDC, and even the voice of the customer, by, Gartner surveys. And, with that, I'll, hand it over to, Alyona, to, walk walk us through, Magic Transits. Thank you. Great. So my name is Ariana, and, I'm Magic Transit product manager. So, excited to go over you with our Magic Transit solution. Great. Let me check the slides. Thanks. So so what is magic transit? As you remember, Omar said that we have solutions for protecting against attacks on multiple levels of TCPIP stack, and Magic Transit is our cloud native service that protects entire customer networks against the attacks. So if you have a data center, any kind of network infrastructure, you have IP space that needs to be protected, Magic Transit is the right choice for that. So how do we do that? So Magic Transit, of all, it absorbs traffic as close as possible to, the source of the attack. We do that by, using BGP announcements. So we are essentially announcing the, IP prefix on your behalf and attracting traffic this way. Then Cloudflare blocks this traffic by using a stack of security systems Umair talked about, and then we get, customers' traffic back to the customers using a variety of options. So one of the options I would like to talk more about is Anycast tunnel over the Internet. This is actually different to what most vendors do, and doing things this way allows network engineers simplify, of all, implementation and, maintenance. They can interact with Cloudflare as one entity, by one point of contact while having the resiliency, across global Internet. So what does this mean, and how does this work? So of all, you'll pick an address on your end, similarly to the regular IPsec or Jira, tunnel setup. Then there is an IP address on the other end of Cloudflare's side. So the difference here is that on our end on Cloudflare's Edge, that IP address is not only one IP address. It actually leaves out every single Cloudflare allocation. So when you connect to Cloudflare Edge, it's one tunnel from your perspective, but, actually, it's hundreds of thousands of tunnels from every server. And every server of our site is able to send traffic to your locations from our perspective. And, of course, why why does this matter? It provides a lot of redundancy and resiliency for the problems that can happen in transit. We all know that the Internet was not built to be 100% reliable, and, there might be issues in transit. And with this anycast mechanism, we are adding additional layer of redundancy on top of it. So that's the option we have. And with this, you would be able to have hundreds of these logical tunnels, set up that connect you to Cloudflare network. On the other hand, we have customers asking us, if they can get a direct connection to us. As often our infrastructure and our customers' infrastructure, they're in the same point of presence. So we do provide this option. We call it Cloudflare network interconnect. And with this option, you would be able to either connect to Cloudflare's network physically or by the partner. And additionally, customers can use virtual cloud with this option as well by using virtual links. In this case, the customer is getting all the benefits of our Anycast architecture. We will mitigate the attack in its closest to the source location, and then we will just send traffic, from that location to your destination to the place that we have physical connect connection set up over an optimized network bus on our end. So with these, options, we are making sure that customers, they have lots of choice, and, we are able to adjust to their, network infrastructure and the way they build, their network. So moving forward, why would people use CloudForm Magic Transit? There are lots of options, and there are, multiple options we notice our customers and prospects, they're using or used in the past. So, usually, we see three types of, network layer protection. So of all, that's specialized hardware like Radware or Arbor hardware. So the downside of these solutions, of course, they can be expensive. You need to plan for capacity and the exact attack size that needs to be mitigated by these boxes. And, of course, it is very difficult to keep up with the changing attack landscape with these boxes as with each, new threat that appears, you need to, update all your boxes to make sure that you get regular software updates. Another option we notice on the market is, software scribing center. So it's essentially DDS protection as a service similar to how software built, the service as well. And, the downside of those solutions, if you remember the if you remember Omar's slides about the capacity and the number of points of presence, it's actually the number of scrubbing centers these providers have is lower compared to what Cloudflare has. So, essentially, whenever there is an attack, these providers, they have to send this traffic to this location. So that's, that adds additional, performance complications. Customers can experience latency. So this is not an ideal solution in terms of, time when you're under attack. Another type of solution we see is, ISP provided protection, which is essentially a combination of the previous two solutions. So ISPs usually, use specialized hardware in a set of, data centers they have, and, they provide protection this way. Of course, that comes with, trade offs as well as they need to, keep, keep up with the changing attack landscape, and, they also need to, route attack traffic to specialized locations. Not every location is able to mitigate these attacks. In contrast, Magic Transits, doesn't require any hardware. It doesn't require any specialized routing when you're under attack. Each location or Cloudflare site is able to mitigate the attacks. And furthermore, Magic Transits fully integrated with all our other services for the best customer experience. Alright. And talking about integration with all the other services that that we have on the Cloudflare side. On the front end, for administrators, for your SOC team, for example, for your NOC team, each service is managed from one interface with one policy for the ease of, Teams operations. We don't have separate dashboards separate product lines, and our customers really love that about the platform. So they're able to see what's happening to that traffic in real time during the attacks. They're able to see both layer seven and layer three layer four mitigations if they're using both products, for example. So this is really helpful. Alright. This these are Cloudflare plans on expanding in 2025. As you can see, we are adding 16 new locations in India, so we are heavily investing in the region. And with this, we're able to provide even, quicker mitigation, even lower latency when it comes to protecting, customers against the attacks. Alright. And lastly, what do our customers say about the solution? Why do they use Magic transit at all? So the feedback is really positive. Some notice, 50% reduction in network maintenance cost. Some notice improvement in latency and faster network performance. Others are impressed by the number of mitigated decks where they don't where they didn't have to do anything. So, essentially, I often hear this feedback. It's it's a set that forget solution. So I set it up according to my traffic profile, and then it just mitigates attack automatically without, any further action from, our SOC or our NOC team. So with this, that's all we have about magic transit. And now we can go to the q and a session. I'm not I think you're muted. Yeah. Yeah. Such a rookie mistake. Yeah. Thank you, Alyona. I was saying thank you, Alyona, for, presenting, presenting that, and, we can now go to the, q and a session. We have, we're seeing here a bunch of, questions, and, I think we can start, kind of, going through them. So I I I think there's an interesting question here from Vivek. What happens if the systems block genuine traffic by mistake? False positives. And the answer to that is that, the system is, mostly, fully configurable. So you can actually change sensitivity levels, allow list, or exclude traffic from, from the rules, to make sure that, that, traffic isn't blocked. But that's kind of after it happened. Before, we deploy new rules and new systems, what we do is basically, we test our rules, invisibly across our network without taking effect. And because we have so much traffic and so many types of customers, we we can see, how the rules are behaving, how the systems are behaving, and optimize and fine tune them. And then we have a process for our enterprise customers, for, proactive false positive prevention. So if we're about to to deploy a new rule, for example, and we detect that, you know, these enterprise accounts are, are susceptible to false positives and they should change the sensitivity of that specific rule to medium, for example, from high to medium, then there will be a proactive outreach, to help them make that change before we deploy the rules. And if this is an emergency type of rule for a maybe a very kind of powerful botnet, then we will do that proactive false positive prevention ourselves and notify the customer, about the changes. Now I see a question here. Alena, I think maybe, you, can address regarding GRE, throughput. So the question is from, Kiran. Can GRE provide higher throughput? I I I don't know if, Kiran meant, compared to, you know, direct connections or IP sec or anything like that. But, Alena, what what do you have to say about, Kiran's question there? Yeah. Sure. So we have noticed customers actually, sending more than 100 gigabits of traffic, to the GRE endpoint, and, we were able to deliver that traffic just fine. When it comes to call ups and network interconnect options, we do have, an option of one gigabit port, ten ten gigabit port, and 100 gigabit ports. So we have a variety of options, and that, of course, depends on the customer preference and their infrastructure plans. Awesome. Thank you. And, another question here from, Vivek. Vivek asks two question about, how often companies should review their DDoS protection plans and what mistakes do organizations usually make when under attack. And I would say that, well, at least, have an annual assessment, but we recommend to do it more frequently. So if, like, I would say that the best best recommendation, is to do it quarterly, and also on demand. And what I mean by on demand is if you're introducing a new service, a new website, then, then go through the the the process of evaluating, the the security posture for that additional service that you introduced, and, also post incident. So if there are any if any anything happens, then, then after that that incident, along with your vendor, see what's what were what what went wrong and what can be fixed or improved, in order to prevent it from reoccurring again. And the common mistakes that we see organizations make, is basically having no strategy in advance. So, and not implementing that. So not having a a response plan. So, and then panicking and blocking legitimate traffic or, pulling their advertisement from, from a network or from, you know, changing the DNS records or trying to kind of fall back on their own infrastructure, and that causes additional disruptions, and the impact to legitimate questions, to legitimate questions, to legitimate, traffic, and can actually go beyond, the, the impact and go beyond the, the the attack duration itself. I think we have time for just another one, just one more question, going through them. They're quite a lot. Alona, is there anyone any question that comes that that is your that you feel like answering here that you wanna address. Yeah. I think we can we can just reply to the last one, about early stage startups and what people should be concerned about. So, yeah, I agree. We have, call for a self serve plan. We have a variety of options. I do not necessarily need enterprise plan for that. We also have a separate program for startups, as far as I'm aware. And in general, we have lots of guides on in calls for deaf dogs on how to protect your side. We have learning paths for that for that. So, yeah, I would start there and, build up kind of, like, from basic protection, all the way up. Thank you. I think one hour almost one hour now. Thank you for attending today's webinar. And, we, if you haven't, please providing your feedback in a survey. And, I'm very much appreciate. And we'll send out the recording, tomorrow. And, if you want, you can review the recording again. Thank you for joining us. Have a good one. Bye bye. Thanks all. Bye.