Quick answer
Anycast is a routing technique where the same IP address is advertised from many locations at once, and the internet's own routing decides which one each visitor reaches — normally the closest in network terms. One address therefore resolves to different physical servers depending on where you are. For content delivery it means lower latency without per-region hostnames, and for DDoS protection it means an attack is automatically divided across every location instead of concentrating on one.
How it works
Under normal unicast routing, an IP address belongs to one place and every packet for it travels there. Anycast breaks that assumption deliberately: multiple locations announce the same prefix over BGP, and each network in between picks whichever announcement looks best from its position.
No special client support is needed. The visitor's computer opens a connection to an address; the network delivers it to the nearest instance. From the visitor's point of view, nothing about it is unusual.
What it gives you
- Lower latency, because the nearest location answers without any DNS trickery
- Automatic failover — if a location goes offline its announcement disappears and traffic reroutes
- Attack division — a distributed attack is split across locations by the same routing that splits real traffic
- One address to manage rather than a different hostname per region
Why it matters for DDoS protection
A botnet attacking an anycast address does not get to choose where its traffic lands. Each bot is routed to whichever location is nearest to it, so an attack from machines spread across the world is spread across the network in the same proportion.
This turns a single-point problem into a shared one. An attack that would saturate one datacentre may be entirely comfortable when divided across a dozen, and it happens automatically — there is no detection step and no failover to trigger.
The trade-offs
Anycast is a poor fit for long-lived stateful connections. Routing can change mid-session — a BGP update reroutes you to a different location that has no idea about your connection state, and it drops. This is why anycast is common for DNS, HTTP and TLS, which are short and can reconnect, and rare for long-running sessions unless state is shared.
It also requires running your own address space and BGP sessions, which is why anycast is something you buy from a provider rather than build for a single service.
Frequently asked questions
Last updated