Skip to content

Add DDoS mitigation reasons section to Spectrum documentation #32077

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
steve-cloudflare merged 1 commit into from
Jul 16, 2026
+16 −1
Merged

Add DDoS mitigation reasons section to Spectrum documentation #32077

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion src/content/docs/spectrum/about/ddos-for-spectrum.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ description: Layer 3 and 4 DDoS protection for TCP and UDP Spectrum applications
products:
- spectrum
weight: 0

---

Spectrum provides DDoS Protection at layers 3-4 of the [OSI model](https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/), that is against TCP and UDP based DDoS attacks.
Expand All @@ -21,3 +20,19 @@ L3/4 DDoS attacks should be detected and mitigated by the [Network-layer DDoS At
For protecting HTTP/S applications against L7 DDoS attacks and to benefit from caching and additional features, onboard your application to Cloudflare’s Web Application Firewall/Content Delivery Network service, which works in tandem with Cloudflare Spectrum.

Refer to [Cloudflare DDoS Protection](/ddos-protection/) to learn more.

---

## Mitigation reasons

The **Mitigation reason** field shown in the **DDoS managed rules** tab of [Network Analytics](/analytics/network-analytics/) (**Networking** > **Insights** > **Network Analytics** in the dashboard) will contain more information on why a given packet was dropped by the Spectrum system.

@cjdoucette cjdoucette Jul 15, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Exact menu placement can change over time, maybe better to just link to NA


The mitigation reasons are the following:

| Reason | Description |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------- |
| **Blocked** | Packet dropped because it matched a DDoS protection rule. |
| **Rate limited** | Packet dropped because it exceeded rate limits. |
| **Connection limited** | Packet dropped because it exceeded connection limits. |
| **Unexpected** | Packet dropped because it was not expected given the current state of the connection it was associated with. |
| **Not found** | Packet dropped because it does not match any configured Spectrum application on the destination IP address and port. |
Loading