Skip to content
Cloudflare Docs

HTTP requests

While in Netflows we can inspect bytes and packets reaching Cloudflare’s edge routers, in HTTP requests we are a layer above in the OSI model ↗. HTTP requests examines complete HTTP requests from end users that reach websites served by Cloudflare’s CDN ↗.

Most of the charts in the Adoption and Usage ↗ section on Radar come from this data source.

These endpoints can be broadly split into:

  • timeseries: A time series of a group of metrics. For example, when looking at IP version, displays an IPv4 time series and an IPv6 time series.
  • summary: Displays a summary of a group of metrics over the specified time range. For example, IPv4 traffic percentage out of the total HTTP traffic during that time period.
  • top: A list of the top locations or Autonomous Systems ↗ (ASes) ranked by adoption of a specific metric. For example, top locations by mobile device traffic (like which locations have a higher percentage of mobile traffic out of the total traffic for that location).

List of endpoints

Timeseries

Example: hourly breakdown by device type

In this example, we will request traffic by device type globally, with and without bot traffic. Parameters for the human series are name=human&botClass=LIKELY_HUMAN&dateRange=1d. For the bot series, the parameters are name=bot&botClass=LIKELY_AUTOMATED&dateRange=1d:

Terminal window
curl "https://api.cloudflare.com/client/v4/radar/http/timeseries/device_type?name=human&botClass=LIKELY_HUMAN&dateRange=1d&name=bot&botClass=LIKELY_AUTOMATED&dateRange=1d&format=json&aggInterval=1h" \
--header "Authorization: Bearer <API_TOKEN>"

Here is the abbreviated response:

{
  "success": true,
  "errors": [],
  "result": {
    "human": {
      "timestamps": ["2022-11-03T13:00:00Z", "2022-11-03T14:00:00Z", ".."],
      "mobile": ["52.5532", "52.146628", ".."],
      "desktop": ["47.394791", "47.800731", ".."],
      "other": ["0.052009", "0.052642", ".."]
    },
    "bot": {
      "timestamps": ["2022-11-03T13:00:00Z", "2022-11-03T14:00:00Z", ".."],
      "desktop": ["83.833892", "84.017711", ".."],
      "mobile": ["16.156748", "15.969936", ".."],
      "other": ["0.00936", "0.012353", ".."]
    },
    "meta": {
      "dateRange": {
        "startTime": "2022-11-03T13:00:00Z",
        "endTime": "2022-11-04T13:00:00Z"
      },
      "normalization": "PERCENTAGE"
    }
  }
}

Mobile devices tend to be considerably more present when examining human generated traffic versus bot generated traffic.

For more information refer to Get device types time series.

Summary

Example: overall breakdown by device type and human/bot traffic

We can also look at the same information asking for a summary of the device type breakdown over the entire period, instead of a per hour breakdown like in the example before.

Terminal window
curl "https://api.cloudflare.com/client/v4/radar/http/summary/device_type?name=human&botClass=LIKELY_HUMAN&dateRange=1d&name=bot&botClass=LIKELY_AUTOMATED&dateRange=1d&format=json&aggInterval=1h" \
--header "Authorization: Bearer <API_TOKEN>"

Here is the abbreviated response:

"human": {
  "mobile": "54.967243",
  "desktop": "44.974006",
  "other": "0.058751"
},
"bot": {
  "desktop": "83.275452",
  "mobile": "16.707455",
  "other": "0.017093"
}

For more information refer to the API reference for this endpoint.

Example: breakdown by IP version and human/bot traffic

In the following example, we will examine global breakdown of traffic by IP version, with and without bots:

Terminal window
curl "https://api.cloudflare.com/client/v4/radar/http/summary/ip_version?name=human&botClass=LIKELY_HUMAN&dateRange=1d&name=bot&botClass=LIKELY_AUTOMATED&dateRange=1d&format=json&aggInterval=1h" \
--header "Authorization: Bearer <API_TOKEN>"

This returns the following:

"human": {
  "IPv4": "76.213647",
  "IPv6": "23.786353"
},
"bot": {
  "IPv4": "91.492032",
  "IPv6": "8.507968"
}

Bots tend to use more IPv4 addresses.

It is also interesting to know how your ISP fares in IPv6 adoption. If you know your ISP’s autonomous system number (ASN), you can use the asn parameter to query for this information. Refer to the API reference for other parameters.

If you do not know your ISP’s ASN, you can use Radar ↗ to find what it is.

Top

Example: top locations by IPv6 traffic

In the following example, we will find which locations had a higher adoption of IPv6 ↗ in the last 28 days.

Terminal window
curl "https://api.cloudflare.com/client/v4/radar/http/top/locations/ip_version/IPv6?name=ipv6&botClass=LIKELY_HUMAN&dateRange=28d&format=json&limit=5" \
--header "Authorization: Bearer <API_TOKEN>"
"ipv6": [
  {
    "clientCountryAlpha2": "IN",
    "clientCountryName": "India",
    "value": "50.612747"
  }, {
    "clientCountryAlpha2": "MY",
    "clientCountryName": "Malaysia",
    "value": "46.233654"
  }, {
    "clientCountryAlpha2": "UY",
    "clientCountryName": "Uruguay",
    "value": "39.796762"
  }, {
    "clientCountryAlpha2": "LK",
    "clientCountryName": "Sri Lanka",
    "value": "39.709355"
  }, {
    "clientCountryAlpha2": "VN",
    "clientCountryName": "Vietnam",
    "value": "39.1514"
  }
]

According to the returned data, India is leading in IPv6 adoption.

For more information refer to the API reference for this endpoint.

Next steps

Refer to Application layer attacks to learn more about mitigfated HTTP requests.

Cloudflare DashboardDiscordCommunityLearning CenterSupport Portal
Cookie Settings