4 ms·

How long does cloudflare keep connection metadata/captured packets?

• majke 9y ago
  This blog post explains our attitude to logging: * https://blog.cloudflare.com/what-cloudflare-logs/ https://blog.cloudflare.com/what-cloudflare-logs/ For attack data we do two things: * We find the attacks and log the attack metadata (dest ip, duration, unique IP count with HLL, etc). This is in database and stored forever. Most of the info in this blog post is from this aggregates. * We automatically capture pcaps for some packet floods. The pcaps are pretty small, contain sampled packets (not full flows), and in many cases don't contain packet payload (netflow doesn't have payloads). These pcaps are kept for about a month and are automatically rotated. The "tcpdump-like" snippets in this blog post are from these files.
  • codezero 9y ago
    Cool thanks for the link to the blog post.