JA EN
shiichan

Tell Mesh, Workers VPC, and Tunnel replicas apart in Cloudflare network logs

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security#infrastructure

Hi, it's Shii-chan! This update makes the question "who made this connection?" much easier to answer in your logs.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Gateway network logs and Zero Trust Network Session Logs now identify two new kinds of traffic:

  • Mesh: traffic sent from or delivered to a Cloudflare Mesh node
  • Workers VPC: traffic sent by a Worker through a Workers VPC binding

You can also see exactly which Cloudflare Tunnel and cloudflared replica received each session.

The story so far

  • Mesh nodes run the Cloudflare One Client in headless mode, so they were logged the same way as devices running the client
  • Workers VPC sessions were not recorded in Network Session Logs

What changes

You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges. That should save effort during security investigations and audits.

Dive Deep

Gateway network logs

In the dashboard, go to Zero Trust > Insights & Logs > Logs > Network logs, select Columns, and turn on Traffic Source and Traffic Destination. Both values also appear under Network query details when you open a log entry.

Network Session Logs

The zero_trust_network_sessions dataset, available through Logpush, includes these fields:

  • OnrampType: how the session entered Cloudflare One. Values: CF1_CLIENT, MESH, WORKERS_VPC, MAGIC, OTHER
  • Offramp: where the session was routed. Sessions routed to a Mesh node report MESH
  • SourceName: name of the Worker that started the session (Workers VPC sessions only)
  • SourceID: stable identifier of that Worker (Workers VPC sessions only)
  • DestinationReplicaID: the replica that served the session (Mesh, Tunnel, or cloudflared)

Note that Workers must be redeployed after September 29, 2026 to populate SourceName and SourceID. No code changes are needed, and past sessions are not backfilled.

Wrap-up

  • Network logs now distinguish Mesh and Workers VPC traffic
  • You can see which Tunnel and cloudflared replica received a session
  • In the dashboard, enable the Traffic Source and Traffic Destination columns
  • Logpush's zero_trust_network_sessions gains OnrampType and more
  • Worker names need a redeploy, and past data isn't backfilled

This is for security teams tracing connections through Zero Trust logs!

Related posts