TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

CGNAT Detection

2 posts · Oct 2021 – Oct 2025

What this trail covers

Cloudflare is developing methods to detect Carrier-Grade Network Address Translation (CGNAT) to mitigate collateral effects of IP-based security mechanisms. This involves building supervised learning classifiers trained on network measurement techniques like distributed traceroutes to distinguish CGNAT IPs from other IP sharing technologies and single-subscriber IPs. The goal is to enable fairer treatment of users behind CGNAT IPs and reduce unintentional bias, particularly in developing regions.

All Cloudflare trails
  1. One IP address, many users: Detecting CGNAT to reduce collateral effectsThis post details Cloudflare's approach to detecting large-scale IP sharing globally, specifically focusing on Carrier-Grade NAT (CGNAT). It explains the socioeconomic bias caused by CGNAT, particularly in developing regions, due to IPv4 scarcity. The post outlines the technical challenge of building a supervised learning classifier due to the lack of labeled datasets. It then describes the methodology for building this dataset, primarily using distributed traceroutes from RIPE Atlas probes to analyze hop sequences and identify private/shared IP ranges (100.64.0.0/10 and RFC 1918) to distinguish CGNAT, single-layer NAT, and non-NAT IPs.
  2. Multi-User IP Address DetectionThis post details the development of a tool to detect when a /24 IP prefix likely contains multi-user IP addresses. It leverages internal and public data sources, analyzing parameters like the number of distinct source ports per IP address and the number of distinct user agents from a given IP. It also uses external data sources like PeeringDB and IRR to infer AS types and identify VPNs/proxies, further refining multi-user IP detection. Validation methods include RIPE Atlas traceroutes and direct confirmation from ISP partners.