“CGNATs also create significant operational fallout stemming from the fact that hundreds or even thousands of clients can appear to originate from a single IP address,” wrote Cloudflare researchers Vasilis Giotsas and Marwan Fayed. “This means an IP-based security system may inadvertently block or throttle large groups of users as a result of a single user behind the CGNAT engaging in malicious activity.”
https://www.theregister.com/2025/11/03/cloudflare_cgnat_bias_research/
Interesting post by Cloudflare on detecting #CGNAT as well as the performance and availability impacts to users behind it: https://blog.cloudflare.com/detecting-cgn-to-reduce-collateral-damage/
This re-enforces the importance for both:
1) content providers to dual-stack sites (so that #IPv6 end-users can bypass CGNAT)
2) the importance for networks to deploy IPv6 alongside CGNAT so that only a shrinking subset of traffic needs to go through CGNAT
Of particular concern is the concentration of CGNAT in the developing world, creating even more risk of a multi-tier Internet with an IPv6-centric modern internet but with other parts of the world being stuck in the past with IPv4 CGNAT.
Interesting post by Cloudflare on detecting #CGNAT as well as the performance and availability impacts to users behind it: https://blog.cloudflare.com/detecting-cgn-to-reduce-collateral-damage/
This re-enforces the importance for both:
1) content providers to dual-stack sites (so that #IPv6 end-users can bypass CGNAT)
2) the importance for networks to deploy IPv6 alongside CGNAT so that only a shrinking subset of traffic needs to go through CGNAT
Of particular concern is the concentration of CGNAT in the developing world, creating even more risk of a multi-tier Internet with an IPv6-centric modern internet but with other parts of the world being stuck in the past with IPv4 CGNAT.
