Skip to content
Cloudflare Docs

Spectrum events

The descriptions below detail the fields available for spectrum_events.

Application

Section titled “Application”

Type: string

The unique public ID of the application on which the event occurred.

ClientAsn

Section titled “ClientAsn”

Type: int

Client AS number.

ClientBytes

Section titled “ClientBytes”

Type: int

The number of bytes read from the client by the Spectrum service.

ClientCountry

Section titled “ClientCountry”

Type: string

Country of the client IP address.

ClientIP

Section titled “ClientIP”

Type: string

Client IP address.

ClientMatchedIpFirewall

Section titled “ClientMatchedIpFirewall”

Type: string

Whether the connection matched any IP Firewall rules. UNKNOWN = No match or Firewall not enabled for Spectrum; UNKNOWN | ALLOW | BLOCK_ERROR | BLOCK_IP | BLOCK_COUNTRY | BLOCK_ASN | WHITELIST_IP | WHITELIST_COUNTRY | WHITELIST_ASN.

ClientPort

Section titled “ClientPort”

Type: int

Client port.

ClientProto

Section titled “ClientProto”

Type: string

Transport protocol used by client; tcp | udp | unix.

ClientTcpRtt

Section titled “ClientTcpRtt”

Type: int

The TCP round-trip time in nanoseconds between the client and Spectrum.

ClientTlsCipher

Section titled “ClientTlsCipher”

Type: string

The cipher negotiated between the client and Spectrum. An unknown cipher is returned as "UNK."

ClientTlsClientHelloServerName

Section titled “ClientTlsClientHelloServerName”

Type: string

The server name in the Client Hello message from client to Spectrum.

ClientTlsProtocol

Section titled “ClientTlsProtocol”

Type: string

The TLS version negotiated between the client and Spectrum; unknown | none | SSLv3 | TLSv1 | TLSv1.1 | TLSv1.2 | TLSv1.3.

ClientTlsStatus

Section titled “ClientTlsStatus”

Type: string

Indicates state of TLS session from the client to Spectrum; UNKNOWN | OK | INTERNAL_ERROR | INVALID_CONFIG | INVALID_SNI | HANDSHAKE_FAILED | KEYLESS_RPC.

ColoCode

Section titled “ColoCode”

Type: string

IATA airport code of the data center that received the request.

ConnectTimestamp

Section titled “ConnectTimestamp”

Type: int or string

Timestamp at which both legs of the connection (client/edge, edge/origin or nexthop) were established.

DisconnectTimestamp

Section titled “DisconnectTimestamp”

Type: int or string

Timestamp at which the connection was closed.

Event

Section titled “Event”

Type: string

connect | disconnect | clientFiltered | tlsError | resolveOrigin | originError.

IpFirewall

Section titled “IpFirewall”

Type: bool

Whether IP Firewall was enabled at time of connection.

OriginBytes

Section titled “OriginBytes”

Type: int

The number of bytes read from the origin by Spectrum.

OriginIP

Section titled “OriginIP”

Type: string

Origin IP address.

OriginPort

Section titled “OriginPort”

Type: int

Origin port.

OriginProto

Section titled “OriginProto”

Type: string

Transport protocol used by origin; tcp | udp | unix.

OriginTcpRtt

Section titled “OriginTcpRtt”

Type: int

The TCP round-trip time in nanoseconds between Spectrum and the origin.

OriginTlsCipher

Section titled “OriginTlsCipher”

Type: string

The cipher negotiated between Spectrum and the origin. An unknown cipher is returned as "UNK."

OriginTlsFingerprint

Section titled “OriginTlsFingerprint”

Type: string

SHA256 hash of origin certificate. An unknown SHA256 hash is returned as an empty string.

OriginTlsMode

Section titled “OriginTlsMode”

Type: string

If and how the upstream connection is encrypted; unknown | off | flexible | full | strict.

OriginTlsProtocol

Section titled “OriginTlsProtocol”

Type: string

The TLS version negotiated between Spectrum and the origin; unknown | none | SSLv3 | TLSv1 | TLSv1.1 | TLSv1.2 | TLSv1.3.

OriginTlsStatus

Section titled “OriginTlsStatus”

Type: string

The state of the TLS session from Spectrum to the origin; UNKNOWN | OK | INTERNAL_ERROR | INVALID_CONFIG | INVALID_SNI | HANDSHAKE_FAILED | KEYLESS_RPC.

ProxyProtocol

Section titled “ProxyProtocol”

Type: string

Which form of proxy protocol is applied to the given connection; off | v1 | v2 | simple.

Status

Section titled “Status”

Type: int

A code indicating reason for connection closure.

Timestamp

Section titled “Timestamp”

Type: int or string

Timestamp at which the event took place.