shield_lock
JinDaGe
← Back to skills
extension
Category: Development & EngineeringNo API key required

cloudflare-traffic-investigator

Investigate traffic anomalies, spikes, and service degradation on Cloudflare-protected domains. Uses cloudflare-mcp-cli for GraphQL analytics, JA4 fingerprint analysis, bot/WAF security scoring, and incident reporting. Use this skill whenever traffic spikes, service overloads, 429 errors, circuit breaker events, Cloudflare analytics, or domain performance issues are mentioned — even if the user doesn't explicitly say "traffic spike". Also triggers when asked to check Cloudflare data for any domain.

personAuthor: jakexiaohubgithub
open_in_newRepositorydownloadDownload package

Investigating Traffic on Cloudflare-Protected Domains

Inputs

Raw arguments: $ARGUMENTS

Infer from the arguments:

  • DOMAIN: Cloudflare-protected domain to investigate
  • ZONE_ID: Cloudflare zone ID for the domain
  • TIME_RANGE: (optional) time range to investigate, in current agent's local timezone (detect via system clock), not UTC

If domain or zone ID cannot be inferred, ask the user via AskUserQuestion. Time range is collected in Step 1 if not provided.

Investigate unusual traffic patterns on Cloudflare-protected domains that cause downstream service failures (e.g., service overload, database saturation, API rate limiting). This skill walks through a structured investigation from confirming the spike through to a full incident report.

Investigation Workflow

Follow these steps in order. Each step file contains detailed instructions and example Cloudflare GraphQL queries.

  1. Get parameters — Collect time range and zone info
  2. Confirm spike — Query hourly traffic to verify the anomaly
  3. Minute-level detail — Narrow to exact spike timing
  4. Identify culprit JA4 — Find JA4 fingerprints with highest request counts
  5. Analyze traffic — For top JA4s, identify paths, user IDs, ASNs
  6. Verify legitimacy — Check bot scores, WAF scores, User-Agent
  7. Extract top users — Find which users made the most requests
  8. Synthesize & report — Combine findings into an incident report

Cloudflare API CLI

All Cloudflare interactions use the cloudflare-mcp-cli CLI tool (via cloudflare-mcp-cli):

  • cloudflare-mcp-cli search '<async fn>' — Discover API endpoints by searching the OpenAPI spec
  • cloudflare-mcp-cli execute '<async fn>' — Execute API calls via cloudflare.request() (GraphQL analytics via POST to /graphql, Radar via REST, zone operations via /zones)

See Cloudflare API CLI Reference for query patterns and examples.

JA4 TLS Fingerprints

  • Format: t13dNNNNNN_XXXXXXXXXXXX_YYYYYYYYYYYY
  • A single fingerprint across millions of requests indicates backend service configuration, not individual users
  • Useful for identifying automated/service-to-service traffic
  • Cross-reference with the CLOUDFLARE_JA4 environment variable before flagging as unknown

Cloudflare Sampled Data

Firewall events use adaptive sampling. Numbers are sampled counts, not actual totals. Use them for pattern identification and relative comparisons — top users in sample likely represent top users overall. Always note this in reports.

Common Failure Patterns

Quickly identify root causes using these patterns:

| Pattern | Signal | Resolution | |---------|--------|------------| | Circuit Breaker Cascade | 429 → timeout → breaker opens | Scale service or add rate limiting | | Retry Storm | Error count exceeds initial traffic | Add exponential backoff, client-side circuit breaker | | Single User Amplification | One user dominates request count | Contact user, fix frontend logic | | Undersized Service | Normal distribution, fails at <10 req/sec | Scale service capacity urgently | | Cascading Failure | Multiple services failing sequentially | Isolate fault, restart root service | | Cache Stampede | Spike after cache expiration | Cache lock, stale-while-revalidate |

Detailed descriptions and resolution steps: Failure Patterns Reference

Escalation Criteria

| Priority | Condition | |----------|-----------| | P1 — Immediate | Service 429 errors / circuit breaker open, >10% error rate, cascading failures | | P2 — High | Single user >500 req/hour on critical endpoint, sustained spike >50% above baseline, multiple dependencies affected | | P3 — Monitor | Moderate increase <50% above baseline, isolated user anomalies |

Incident Report

Document findings using the Incident Report Template covering metrics, timeline, security analysis, root cause, and recommendations.

Tips

  • Ask for time range first using AskUserQuestion if not provided
  • Identify JA4 dynamically — query Cloudflare, don't assume
  • Only ask the user about unknown/suspicious User-Agents — skip well-known bots and clearly internal services
  • Calculate actual req/sec to understand service load
  • Document findings immediately using the incident template

Reference Files

Steps

  1. Get parameters
  2. Confirm spike
  3. Minute-level detail
  4. Identify culprit JA4
  5. Analyze traffic
  6. Verify legitimacy
  7. Extract top users
  8. Synthesize & report

References