# US 2014/0157416 A1 · Determining the Likelihood of Traffic Being Legitimately Received At a Proxy Server in a Cloud-Based Proxy Service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157416 A1 - Document ID: US20140157416A1 - Status: Published application - Kind: A1 - Application number: 14/172,823 - Filed: 2014-02-04 - Published: 2014-06-05 - Earliest claimed: 2012-08-07 - Assignees: Cloudflare, Inc. - Inventors: Lee Hahn Holloway; Srikanth N. Rao; Matthew Browning Prince; Matthieu Philippe François Tourne; Ian Gerald Pye; Ray Raymond Bejjani; Terry Paul Rodery, JR. - Web page: https://patentgrep.com/patent/US20140157416A1 ## CPC - H04L 63/1458: {Denial of Service} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/0281: {Proxies} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Message(s) are received from each one of multiple proxy servers, which are anycasted to the same IP address, that indicate source IP addresses of packets that are received that are directed to that same IP address. These proxy servers receive the packets as result of domain(s) resolving to that same IP address, and a particular one of the proxy servers receives the packets as a result of an anycast protocol implementation selecting that proxy server. Based on these message(s) from each of the proxy servers, a determination of the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers is determined. A message is transmitted to each of the proxy servers that indicates which source IP addresses of packets are not likely to be legitimately received at that proxy server. ## Claims ### Claim 1 A method for determining a likelihood of a packet having a particular source address being received at a particular one of a plurality of proxy servers that are anycasted to a same IP address, wherein the proxy servers are part of a cloud-based proxy service and are situated between a plurality of client computing devices accessing network resources and a plurality of origin servers that serve network resources, the method comprising: receiving, from each of the plurality of proxy servers, one or more messages that indicate source IP addresses of packets received at that proxy server that are directed to the same IP address, wherein the proxy servers receive traffic at the same IP address as a result of one or more domains resolving to the same IP address; and wherein a particular one of the proxy servers receives packets directed to the same IP address as a result of an anycast protocol implementation selecting that particular one of the proxy servers as the closest in terms of routing protocol metric used to route traffic to the proxy servers; determining, based on the one or more messages from each of the plurality of proxy servers, a likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers; transmitting, to each of the proxy servers, a message that indicates which source IP addresses of packets are not likely to be legitimately received at that proxy server. ### Claim 2 (depends on 1) The method of claim 1, wherein the message transmitted to each of the proxy servers includes a set of rules to rate limit packets received with source IP addresses that are not likely to be legitimately received by that proxy server. ### Claim 3 (depends on 1) The method of claim 1, wherein the message transmitted to each of the proxy servers includes a set of rules to block packets received with source IP addresses that are not likely to be legitimately received by that proxy server. ### Claim 4 (depends on 1) The method of claim 1, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are likely to be legitimately received at that proxy server. ### Claim 5 (depends on 1) The method of claim 1, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are not likely to be legitimately received at that proxy server. ### Claim 6 (depends on 1) The method of claim 1, wherein the step of receiving from each of the plurality of proxy servers the one or more messages that indicate source IP addresses of packets received at that proxy server that are directed to the same IP address, occurs only when the same IP address is not believed to be currently under a denial of service (DoS) attack. ### Claim 7 (depends on 1) The method of claim 1, wherein the one or more messages received from each of the plurality of proxy servers further indicates a number of packets of each source IP address received at that proxy server. ### Claim 8 (depends on 1) The method of claim 1, wherein the one or more messages are received as a result of a client-side script that is inserted by the proxy servers into web pages of domains that resolve to the same IP address, wherein the client-side script, when executed, causes a packet to be transmitted to the same IP address. ### Claim 9 (depends on 1) The method of claim 1, further comprising: responsive to a network event that affects the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers, transmitting a message to the proxy servers that indicates a suspension of any rate limits that have been installed as a result of transmitting the messages to the proxy servers that indicate which source IP addresses of packets are not likely to be legitimately received at the proxy servers. ### Claim 10 An apparatus, comprising: a plurality of proxy servers that are anycasted to a same IP address, wherein each of the plurality of proxy servers is configured to perform the following: receive packets at the same IP address as a result of one or more domains resolving to the same IP address, wherein this proxy server receives the packets at the same IP address as a result of an anycast protocol implementation selecting this one of the plurality of proxy servers as the closest in terms of routing protocol metric used to route traffic to the plurality of proxy servers; transmit one or more messages to a central server that indicate source IP addresses of the received packets; and receive, from the central server, a message that indicate source IP addresses of packets that are not likely to be legitimately received at that proxy server; and install, based on the received message, one or more rules to rate limit packets that are received having a source IP address that is not likely to be legitimately received at that proxy server; and the central server coupled with the plurality of proxy servers, wherein the remote server is configured to perform the following: receive, from each of the plurality of proxy servers, the one or more messages that indicate source IP addresses of the received packets; determine, based on the one or more messages received from the plurality of proxy servers, a likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers; and transmit, to each of the proxy servers, the message that indicates which source IP addresses of packets are not likely to be legitimately received at that proxy server. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the message transmitted to each of the proxy servers includes a set of rules to rate limit packets received with source IP addresses that are not likely to be legitimately received by that proxy server. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein the message transmitted to each of the proxy servers includes a set of rules to block packets received with source IP addresses that are not likely to be legitimately received by that proxy server. ### Claim 13 (depends on 10) The apparatus of claim 10, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are likely to be legitimately received at that proxy server. ### Claim 14 (depends on 10) The apparatus of claim 10, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are not likely to be legitimately received at that proxy server. ### Claim 15 (depends on 10) The apparatus of claim 10, wherein the proxy servers are configured to transmit the one or more messages to the central server that indicate source IP addresses of the received packets only when the destination IP address of those packets is not believed to be currently under a denial of service (DoS) attack. ### Claim 16 (depends on 10) The apparatus of claim 10, wherein the one or more messages to be transmitted by each of the proxy servers further indicates a number of packets of each source IP address received at that proxy server. ### Claim 17 (depends on 10) The apparatus of claim 10, wherein the one or more messages to be transmitted by each of the proxy servers are to be transmitted as a result of a client-side script that is inserted by the proxy servers into web pages of domains that resolve to the same IP address, wherein the client-side script, when executed, causes a packet to be transmitted to the same IP address. ### Claim 18 (depends on 10) The apparatus of claim 10, further comprising: responsive to a network event that affects the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers, transmitting a message to the proxy servers that indicates a suspension of any rate limits that have been installed as a result of transmitting the messages to the proxy servers that indicate which source IP addresses of packets are not likely to be legitimately received at the proxy servers. ### Claim 19 A non-transitory computer-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations for determining a likelihood of a packet having a particular source address being received at a particular one of a plurality of proxy servers that are anycasted to a same IP address, wherein the proxy servers are part of a cloud-based proxy service and are situated between a plurality of client computing devices accessing network resources and a plurality of origin servers that serve network resources, the operations comprising: receiving, from each of the plurality of proxy servers, one or more messages that indicate source IP addresses of packets received at that proxy server that are directed to the same IP address, wherein the proxy servers receive traffic at the same IP address as a result of one or more domains resolving to the same IP address; and wherein a particular one of the proxy servers receives packets directed to the same IP address as a result of an anycast protocol implementation selecting that particular one of the proxy servers as the closest in terms of routing protocol metric used to route traffic to the proxy servers; determining, based on the one or more messages from each of the plurality of proxy servers, a likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers; transmitting, to each of the proxy servers, a message that indicates which source IP addresses of packets are not likely to be legitimately received at that proxy server. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the message transmitted to each of the proxy servers includes a set of rules to rate limit packets received with source IP addresses that are not likely to be legitimately received by that proxy server. ### Claim 21 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the message transmitted to each of the proxy servers includes a set of rules to block packets received with source IP addresses that are not likely to be legitimately received by that proxy server. ### Claim 22 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are likely to be legitimately received at that proxy server. ### Claim 23 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the message transmitted to each of the proxy servers specifies the source IP addresses of packets that are not likely to be legitimately received at that proxy server. ### Claim 24 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the step of receiving from each of the plurality of proxy servers the one or more messages that indicate source IP addresses of packets received at that proxy server that are directed to the same IP address, occurs only when the same IP address is not believed to be currently under a denial of service (DoS) attack. ### Claim 25 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the one or more messages received from each of the plurality of proxy servers further indicates a number of packets of each source IP address received at that proxy server. ### Claim 26 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the one or more messages are received as a result of a client-side script that is inserted by the proxy servers into web pages of domains that resolve to the same IP address, wherein the client-side script, when executed, causes a packet to be transmitted to the same IP address. ### Claim 27 (depends on 19) The non-transitory computer-readable storage medium of claim 19, wherein the operations further comprise: responsive to a network event that affects the likelihood of a packet having a particular source IP address being legitimately received at each of the proxy servers, transmitting a message to the proxy servers that indicates a suspension of any rate limits that have been installed as a result of transmitting the messages to the proxy servers that indicate which source IP addresses of packets are not likely to be legitimately received at the proxy servers.