Understanding Internet Observability: How Cloudflare Radar Transforms Network Intelligence

In my role as Support Team Leader at InterLIR, I regularly encounter network administrators and organizations grappling with visibility challenges across their IPv4 infrastructure. The Internet’s complexity has grown exponentially, yet our ability to observe and understand its behavior hasn’t always kept pace. This is why platforms like Cloudflare Radar represent such a significant advancement in network intelligence-they provide the transparency that modern network management demands.

Since its 2020 launch, Cloudflare Radar has evolved from a basic monitoring tool into a comprehensive Internet observability platform. For those of us working in the IPv4 marketplace and network infrastructure space, understanding these capabilities is essential. This article examines Radar’s evolution, its practical applications for network professionals, and what its development tells us about the future of Internet transparency.

The Foundation: Why Internet Observability Matters

When I discuss network challenges with clients at InterLIR, a common theme emerges: organizations struggle to understand what’s happening across their digital infrastructure. They know their IPv4 addresses are valuable assets, but visibility into how those addresses interact with the broader Internet ecosystem remains limited. This is precisely the problem Cloudflare Radar addresses.

The Internet operates through countless interconnected networks, each making independent routing decisions, implementing security policies, and responding to threats. Without comprehensive observability tools, network administrators operate partially blind-reacting to problems rather than anticipating them. Radar’s mission centers on Internet measurement, transparency, and resilience, using aggregated data from Cloudflare’s global network to illuminate patterns that would otherwise remain invisible.

The Evolution of Radar’s Capabilities

Radar’s development trajectory reflects the growing complexity of Internet management. The platform launched with three core components-Internet Insights, Domain Insights, and IP Insights-that provided foundational visibility. However, as network threats evolved and new technologies emerged, Radar expanded its scope considerably:

1. 2020: Initial launch established baseline monitoring capabilities across Internet traffic, domain activity, and IP address behavior
2. 2022: Route leak detection and the Radar API introduced programmatic access and routing security visibility
3. 2023: Origin hijack detection, automated notifications, and URL Scanner added critical security monitoring
4. 2024: Internationalization support across 14 languages and TCP reset monitoring expanded global accessibility and censorship visibility
5. 2025: Certificate Transparency monitoring and real-time BGP route visibility provided deeper security and routing intelligence

What distinguishes Radar from other monitoring tools is its commitment to accessibility. Everything is built on a publicly-accessible API, enabling organizations to integrate this intelligence into their own systems. For network professionals managing IPv4 infrastructure, this programmatic access is invaluable-it allows automated monitoring and alerting that can prevent costly outages or security incidents.

Security Intelligence: Protecting Network Infrastructure

In my conversations with network administrators, security concerns consistently rank among their top priorities. The threat landscape has become increasingly sophisticated, with attacks ranging from certificate fraud to state-sponsored connection tampering. Radar’s security features provide visibility that helps organizations protect their infrastructure proactively.

Certificate Transparency: The Foundation of Trust

Digital certificates form the backbone of secure Internet communication. When you access a website via HTTPS, certificates verify that you’re connecting to the legitimate server rather than an imposter. Certificate Authorities function as trusted gatekeepers, but what happens when a CA is compromised or issues fraudulent certificates?

Radar’s Certificate Transparency monitoring, introduced in 2025, addresses this vulnerability. CT logs create a public, auditable record of every certificate issued, making it possible to detect fraudulent or mis-issued certificates before they compromise security. For organizations managing multiple domains across their IPv4 address space, this visibility is crucial-it enables rapid detection of unauthorized certificates that could facilitate man-in-the-middle attacks.

Connection Tampering Detection

One of Radar’s most significant contributions came through its collaboration with Cloudflare’s Research team on connection tampering detection. Based on research published in the paper “Global, Passive Detection of Connection Tampering,” Radar now provides visibility into TCP resets and timeouts at global and country levels.

The research revealed a startling finding: approximately 20% of all connections to Cloudflare close unexpectedly before any useful data exchange occurs. This behavior is consistent with connection tampering by third parties, often indicating government censorship or content filtering. For organizations operating internationally, this visibility helps identify markets where connectivity may be unreliable or where content restrictions could impact service delivery.

Post-Quantum Encryption Adoption

The quantum computing threat to current encryption standards represents a long-term security challenge that organizations must address today. Radar tracks the adoption of post-quantum encryption across HTTPS traffic, providing visibility into how quickly the Internet ecosystem is adapting to this emerging threat.

The data is encouraging: post-quantum encrypted traffic grew from under 3% at the beginning of 2024 to over 47% later that year, driven by major browsers and code libraries activating post-quantum support by default. For network administrators planning security roadmaps, this metric provides valuable context for prioritizing post-quantum migration efforts.

AI Impact: Understanding the New Content Ecosystem

The rapid proliferation of AI platforms has fundamentally altered the relationship between content creators and search engines. At InterLIR, we’ve observed how this shift affects organizations across industries-from content publishers to e-commerce platforms. Radar’s AI Insights provide crucial visibility into this evolving landscape.

The AI Crawler Challenge

Since OpenAI’s ChatGPT launch in November 2022, AI platforms have aggressively crawled websites to train their models, often without compensating content creators. Simultaneously, search engines have evolved into answer engines that provide direct answers rather than referral traffic. This creates a significant imbalance: AI systems consume content while returning minimal traffic to the original creators.

Radar’s AI Insights page addresses this transparency gap through several key metrics:

Industry-Specific Intelligence

Radar allows filtering of AI crawler data by industry category, providing organizations with visibility into how their peers are responding to AI crawlers. This comparative data is invaluable for developing effective strategies. For example, news publishers may adopt different approaches than e-commerce platforms, and understanding these patterns helps organizations make informed decisions about managing AI access to their content.

From a business perspective, this intelligence helps organizations balance the potential benefits of AI visibility against the costs of content consumption. Some organizations may choose to block AI crawlers entirely, while others may negotiate licensing agreements or implement selective access controls based on the specific crawler and its purpose.

Routing Visibility: Maintaining Network Resilience

In my work at InterLIR, routing issues represent some of the most critical challenges our clients face. When routing goes wrong, entire networks can go offline, affecting countless services and users. Radar’s routing visibility capabilities help identify and mitigate these problems before they escalate into major outages.

Route Leaks and Origin Hijacks

Two critical routing issues threaten network stability: route leaks and origin hijacks. Route leaks occur when routing announcements propagate beyond their intended scope, potentially directing traffic through unintended networks. Origin hijacks involve attackers falsely claiming ownership of IP address blocks, enabling traffic interception or denial of service attacks.

Radar’s detection capabilities for these issues, introduced in 2022 and 2023 respectively, help network operators identify when their networks may be party to such events-either as perpetrators or victims. More importantly, Radar introduced automated notifications for these events, alerting subscribers via email or webhook when problems are detected. This enables immediate action, potentially preventing or minimizing service disruptions.

Real-Time BGP Route Monitoring

Border Gateway Protocol (BGP) routing forms the foundation of Internet connectivity, determining how data packets travel between networks. Radar’s 2025 addition of real-time BGP route monitoring provides unprecedented visibility into these routing decisions. Network administrators can see how specific network prefixes connect to other networks, showing the paths packets take from IP address blocks to major tier 1 network providers.

This visibility is particularly valuable when troubleshooting outages, implementing new deployments, or investigating routing anomalies. For organizations managing IPv4 address space, understanding how their addresses are advertised and routed across the Internet is essential for maintaining reliable connectivity and identifying potential security issues.

AS-SET Monitoring

Another 2025 addition, AS-SET monitoring, enables network operators to track valid and invalid AS-SET memberships for their networks. An AS-SET represents a grouping of related networks, typically used to represent a list of downstream customers of a network provider. Monitoring these relationships helps prevent misuse and reduces the risk of issues like route leaks.

For network operators, this capability provides visibility into their network’s relationship with the broader Internet ecosystem. It helps identify misconfigurations before they cause problems and provides documentation of legitimate network relationships that can be valuable during incident response or troubleshooting.

Programmatic Access: Integrating Intelligence into Operations

While Radar’s visualizations provide valuable insights, the platform’s true power lies in its programmatic access capabilities. At InterLIR, we emphasize the importance of automation in network management-manual monitoring simply cannot scale to meet modern demands. Radar’s API and integration capabilities enable organizations to incorporate Internet intelligence into their operational workflows.

The Radar API

Launched in 2022, the Radar API provides programmatic access to all the data shown on Radar, along with advanced filters for specific queries. Requiring only an access token, the API enables developers, researchers, and organizations to incorporate Radar data into their own tools, websites, and applications.

For example, a network operations center could use the API to automatically retrieve routing information for their IP address space, compare current routing patterns against historical baselines, and generate alerts when anomalies are detected. This automation transforms Radar from a reactive monitoring tool into a proactive intelligence platform that integrates seamlessly with existing operational workflows.

Model Context Protocol Integration

The Model Context Protocol (MCP) represents a standardized way to make information available to large language models. Radar’s MCP server allows AI systems to access Radar data and tools through natural language queries, making the platform’s wealth of Internet data accessible to AI-powered operational tools.

This integration is particularly valuable for organizations adopting AI-assisted network management. Instead of manually querying APIs or navigating dashboards, network administrators can ask natural language questions and receive contextually relevant answers drawn from Radar’s comprehensive data sets. This reduces the time required to gather intelligence during incident response and makes Radar’s capabilities accessible to team members who may not have deep technical expertise.

URL Scanner

One of Radar’s most popular tools, the URL Scanner, has analyzed millions of websites since its 2023 launch. It allows users to safely determine whether a site may contain malicious content while also providing information on technologies used and insights into the site’s headers, cookies, and links. Available through both the API and MCP server, the URL Scanner can be integrated into security workflows, enabling automated scanning of suspicious URLs without exposing users to potential threats.

Practical Applications for Network Professionals

Understanding Radar’s capabilities is valuable, but the real question is how network professionals can apply these tools to solve practical problems. Based on my experience working with network administrators at InterLIR, I’ve identified several high-value use cases:

IPv4 Address Space Management

Organizations managing IPv4 address space can use Radar’s routing visibility to monitor how their addresses are advertised and routed across the Internet. This helps identify unauthorized announcements, detect potential hijacking attempts, and verify that routing policies are being implemented correctly. The automated notification capabilities ensure that routing issues are detected and addressed quickly, minimizing potential service disruptions.

Security Posture Assessment

Radar’s security features enable comprehensive assessment of an organization’s security posture. Certificate Transparency monitoring helps identify unauthorized certificates, connection tampering detection reveals potential censorship or filtering, and post-quantum encryption tracking provides visibility into adoption of next-generation security standards. Together, these capabilities provide a holistic view of security risks and opportunities for improvement.

Content Strategy Development

For organizations that publish content online, Radar’s AI Insights provide crucial intelligence for developing content strategies in the AI era. By understanding which AI platforms are crawling content, how frequently they’re accessing it, and what value they’re returning through referral traffic, organizations can make informed decisions about access control, licensing, and content distribution strategies.

Incident Response and Troubleshooting

When network issues occur, rapid diagnosis is essential. Radar’s comprehensive visibility into routing, security, and traffic patterns provides valuable context during incident response. Network administrators can quickly determine whether issues are isolated to their network or part of broader Internet problems, identify potential causes, and verify that remediation efforts are effective.

The Future of Internet Observability

Radar’s evolution reflects broader trends in Internet management and the growing recognition that comprehensive observability is essential for maintaining reliable, secure digital infrastructure. Several factors are driving this trend:

Increasing Complexity

The Internet continues to grow more complex, with new technologies, protocols, and services constantly emerging. This complexity makes manual monitoring increasingly impractical-organizations need automated intelligence platforms that can process vast amounts of data and surface actionable insights.

Evolving Threat Landscape

Cybersecurity threats continue to evolve in sophistication and scale. From state-sponsored attacks to automated bot networks, the range of threats facing network infrastructure has never been broader. Comprehensive observability platforms like Radar provide the visibility needed to detect and respond to these threats effectively.

Regulatory Requirements

Regulatory frameworks increasingly require organizations to demonstrate security controls and incident response capabilities. Comprehensive observability platforms provide the documentation and audit trails needed to demonstrate compliance while also improving actual security posture.

AI Integration

As AI systems become more sophisticated, their integration with observability platforms will enable new capabilities. Radar’s MCP integration represents an early step in this direction, but future developments will likely include AI-powered anomaly detection, automated incident response, and predictive analytics that anticipate problems before they occur.

Evgeny Sevastyanov

Support Team Leader