TechPrufer
Sign inGet started

Blogs›Cloudflare›CGNAT Detection

CGNAT Detection

CGNAT Detection

2
posts
2021–2025

Cloudflare is developing methods to detect Carrier-Grade Network Address Translation (CGNAT) to mitigate collateral effects of IP-based security mechanisms. This involves building supervised learning classifiers trained on network measurement techniques like distributed traceroutes to distinguish CGNAT IPs from other IP sharing technologies and single-subscriber IPs. The goal is to enable fairer treatment of users behind CGNAT IPs and reduce unintentional bias, particularly in developing regions. This post details the development of a multi-user IP address detection system that leverages internal and public data sources, including TCP connection source port counts and user agent analysis, to identify /24 IP prefixes likely to contain multi-user IPs. It also discusses the use of PeeringDB and IRR data to infer AS types and refine CGNAT detection, and validation methods using RIPE Atlas traceroutes and ISP partnerships.

2025

One IP address, many users: Detecting CGNAT to reduce collateral effects

10/29/2025

This post introduces Cloudflare's approach to detecting Carrier-Grade Network Address Translation (CGNAT) to reduce collateral effects of IP-based security mechanisms. It details the motivation behind this work, highlighting the socioeconomic bias CGNAT can introduce, especially in developing regions. The post outlines the technical challenge of building a labeled dataset for training ML classifiers and describes the use of distributed traceroutes, analyzing hop sequences and the presence of RFC 6598 and RFC 1918 addresses, to infer CGNAT presence. This contributes to a new capability focused on identifying and mitigating the impact of large-scale IP sharing.

2021

Multi-User IP Address Detection

10/15/2021

This post details the development of a multi-user IP address detection system. It leverages internal data (TCP connection source port counts, user agent analysis) and public data sources (PeeringDB, IRR) to identify /24 IP prefixes likely to contain multi-user IPs. Validation methods using RIPE Atlas traceroutes and ISP partnerships are also discussed.