SYSTEM Cited by 1 source

Cloudflare Spectrum

Spectrum is Cloudflare's ingress proxy for non-HTTP traffic — it allows Cloudflare to sit in front of any TCP or UDP application, extending the 330+ location anycast network to arbitrary L4 protocols.

Architecture

Spectrum has historically proxied TCP/UDP connections directly to customer origin servers. As of August 2026, a new application type routes incoming TCP connections to a specified Worker rather than directly to an origin — the Worker receives the socket via the new connect(socket) handler and can pass it through a routing chain (Worker → Durable Object → Container).

This turns Spectrum into a programmable TCP ingress layer where the Worker controls where and how the connection is routed.

Capabilities

• TCP and UDP ingress proxy on Cloudflare's anycast network
• DDoS protection for non-HTTP traffic
• Routes to origin servers (traditional mode)
• Routes to Workers via connect(socket) handler (new, private beta 2026-08)
• Enables gRPC, custom TCP protocols, and any non-HTTP application to run behind Cloudflare

Seen in

• sources/2026-08-03-cloudflare-workers-and-containers-now-support-inbound-tcp-connections-and-grpc — new Worker-routing mode for inbound TCP, enabling gRPC and arbitrary TCP protocols on the platform
• sources/2026-06-10-cloudflare-route-public-traffic-to-private-applications — Spectrum L4 proxy shares the unified connectivity layer with HTTP proxy and Workers VPC