What does Flowtriq detect that Cloudflare does not?

Flowtriq detects L3/L4 attacks hitting your server directly: UDP floods, SYN floods, ICMP floods, DNS amplification, NTP amplification, and any volumetric attack targeting your IP address. It also builds per-server baselines, captures PCAP evidence on every attack, and detects below-threshold attacks that target individual services on a specific port. Cloudflare sees HTTP requests at its edge. Flowtriq sees every packet at your server.

Cloudflare DDoS Complement

The DDoS detection layer Cloudflare does not cover

Q: Can Flowtriq trigger Cloudflare Magic Transit?

Yes. Flowtriq integrates with Cloudflare Magic Transit as a scrubbing tier. When Flowtriq detects an attack that exceeds local mitigation capacity, it can auto-trigger Magic Transit to divert traffic through Cloudflare for volumetric scrubbing, then auto-withdraw when the attack ends.

Cloudflare protects HTTP/HTTPS traffic behind its proxy. But your bare-metal servers, game servers, mail servers, VoIP, and non-HTTP services are not behind Cloudflare. Flowtriq fills that gap with per-server L3/L4 detection at $9.99/node/month.

Start Free Trial → See the Gap →

L3/L4 detection Per-server visibility $9.99/node/month Works with Cloudflare Magic Transit auto-trigger

The visibility gap

What Cloudflare protects and what it does not

Cloudflare is excellent at what it does. It protects HTTP traffic at the edge. But infrastructure operators run more than just websites. Here is what is left exposed.

Bare-metal and colo servers

Dedicated servers in colocation facilities have public IPs that clients connect to directly. Cloudflare's reverse proxy does not see this traffic. A UDP flood hitting your server's IP bypasses Cloudflare entirely unless you use Magic Transit (enterprise pricing).

Game servers

Game servers use UDP (Minecraft, FiveM, Rust, ARK, CS2) and require direct client-to-server connections. Cloudflare Spectrum supports TCP proxying at $1/GB, but most game protocols are UDP and need direct IP connectivity. Flowtriq detects attacks on any port and protocol.

Mail servers and VoIP

SMTP, SIP, and RTP traffic cannot be proxied through Cloudflare. These services run on your server's IP and need direct connectivity. A SIP flood or SMTP bomb targeting your mail server is invisible to Cloudflare.

Custom TCP/UDP applications

APIs, databases, monitoring agents, VPN endpoints, and any non-HTTP service that listens on your server's IP are outside Cloudflare's proxy protection. If an attacker knows your origin IP, they can target these services directly.

Better together

How Cloudflare and Flowtriq work together

Cloudflare handles L7 at the edge. Flowtriq handles L3/L4 at the server. Together, you get full-stack DDoS visibility.

Layer	Flowtriq	Cloudflare
L7 HTTP/HTTPS protection	Not a reverse proxy	Industry-leading L7 proxy protection
L3/L4 per-server detection	Per-node baselines, 1-2s detection	Only sees proxied traffic
Non-HTTP services	Any protocol, any port	Spectrum (TCP only, per-GB pricing)
Server-side PCAP	Automatic on every attack	Edge-level analytics only
Local firewall mitigation	iptables/nftables at kernel level	N/A (edge-based)
BGP FlowSpec/RTBH	8 BGP adapters	N/A
Magic Transit auto-trigger	Native integration	Always-on or on-demand
Per-server baselines	Dynamic per-node	Edge-aggregate only
Pricing	$9.99/node/month	Free (HTTP proxy), enterprise (Magic Transit)

When to add Flowtriq

Scenarios where Flowtriq complements Cloudflare

Bare-metal and colocation

Your servers have public IPs. Cloudflare's proxy protects your domain, but attackers who discover your origin IP can target it directly. Flowtriq detects these L3/L4 attacks at the server level.

Game server hosting

Game servers need direct UDP connectivity. Cloudflare's proxy does not cover these. Flowtriq detects UDP floods, SYN floods, and amplification attacks targeting game server ports.

Hosting providers

Your customers run diverse workloads. Cloudflare covers their websites, but their backend services, mail servers, and custom applications need per-server protection that Cloudflare does not provide.

ISPs and transit providers

Cloudflare protects HTTP at the edge. It does not protect your core network, subscriber infrastructure, or transit links. Flowtriq adds per-node and flow-based detection across your network.

Common questions

Cloudflare DDoS and Flowtriq: FAQ

Does Cloudflare protect against all DDoS attacks?

Cloudflare provides excellent protection for HTTP/HTTPS traffic behind its reverse proxy. However, any traffic that does not pass through Cloudflare's proxy is not covered. Bare-metal servers, game servers, mail servers, VoIP, custom TCP/UDP services, and any direct-IP connectivity are exposed unless you use Spectrum or Magic Transit.

Does Flowtriq compete with Cloudflare?

No. Flowtriq and Cloudflare are complementary. Cloudflare protects HTTP traffic at the edge. Flowtriq protects the infrastructure layer that Cloudflare does not see. Many operators run both: Cloudflare for their websites, Flowtriq on their servers for per-node L3/L4 detection. Flowtriq can also auto-trigger Cloudflare Magic Transit as a mitigation tier.

Can Flowtriq trigger Cloudflare Magic Transit?

Yes. Flowtriq integrates natively with Cloudflare Magic Transit. When an attack exceeds local mitigation capacity, Flowtriq can auto-trigger Magic Transit to divert traffic through Cloudflare for volumetric scrubbing, then auto-withdraw when the attack ends. This gives you on-demand scrubbing without always-on costs.

How much does Flowtriq cost compared to Cloudflare?

Cloudflare offers free DDoS protection for HTTP traffic behind its proxy. Cloudflare Spectrum starts at $1/GB. Magic Transit requires enterprise pricing. Flowtriq costs $9.99/node/month for per-server detection across all protocols, with no per-GB charges.

What if attackers bypass Cloudflare by targeting my origin IP?

This is the most common DDoS scenario for Cloudflare users. If your origin IP is exposed (via DNS history, subdomain scanning, or email headers), attackers bypass Cloudflare entirely. Flowtriq detects these origin-targeted attacks in 1-2 seconds and mitigates them with local firewall rules, BGP FlowSpec, RTBH, or cloud scrubbing.