anycst.uk
BGP · anycast routing, visualized

One IP address.
Announced from everywhere.

Anycast lets many servers around the world share a single IP. The network quietly routes each packet toward the most preferred nearby location. Here's what that actually looks like.

Anycast nodeLocal networks
anycast IP 203.0.113.10
14/14 nodes announcing

Each node serves the local networks around it. BGP routes each network toward its preferred available node — no central hub.

The routing loop

How a packet finds its preferred node

Anycast isn't magic — it's just BGP doing what it always does, applied cleverly. Four steps establish the route; the forwarding plane then applies that decision to millions of packets a second.

  1. 01

    Advertise the same prefix

    Every point of presence announces the identical IP prefix into BGP. The internet now sees one destination reachable from many places at once.

  2. 02

    Routers pick the best path

    Each network selects its preferred route by BGP policy — usually, but not always, the topologically nearest PoP. No DNS tricks, no client logic required.

  3. 03

    Packets land at a nearby node

    A user in Tokyo will often reach the Tokyo node; a user in London will often reach London. Same address, usually with much shorter round-trips.

  4. 04

    Failure reroutes automatically

    When a PoP withdraws its announcement, BGP reconverges and traffic shifts to the next-preferred available node — usually within seconds, though convergence isn't instant.

Zoom in · one node

Inside a PoP: one IP, many servers

Anycast gets you to a preferred nearby point of presence — but a PoP isn't a single machine. It's a rack of servers that all answer the same address. A common design uses ECMP (Equal-Cost Multi-Path) at the edge to hash every flow to one of them, spreading load while keeping each connection pinned to its server.

8/8 servers live
one IP 203.0.113.10 · many servers

ECMP hashes each flow's 5-tuple to one server — same flow, same server, so TCP/TLS sessions stay intact. Drain a server and new flows are distributed across the remaining machines while existing connections are allowed to finish where supported.

203.0.113.10 is an illustrative documentation address. Real deployments announce an accepted IP prefix, not a globally routed individual /32.

Side by side

Unicast vs Anycast

Same packets, very different journeys. The only change is how many places advertise the address.

Property
Unicast
Anycast
IP announcement
One network location announces the destination
Many locations announce the same destination
Routing decision
Traffic converges on the same location
BGP selects among multiple locations
Latency
Fixed — as far as that one advertised location is
Often low — traffic can stay regional
Failure behavior
Outage until you fail over
Reroutes automatically to another available node
DDoS absorption
One target soaks all the traffic
Attack can split across multiple nearby PoPs

Why it matters

Fast, tough, and straightforward to expand

The reasons DNS roots, major CDNs, and many global APIs run on anycast today.

Lower latency, everywhere

Because traffic often terminates at a preferred nearby PoP, round-trips shrink. Users in many regions feel like the service is next door.

~10–40 ms

typical regional round-trip

Resilient by design

Withdraw a route and BGP reconverges in seconds. There is no single box to knock over — the address simply lives elsewhere.

N+1

every node is a backup

Scales with the internet

Stand up a new PoP, announce the same prefix, and once upstreams accept the route it starts serving nearby traffic. No client changes, no DNS churn.

1 IP

many PoPs, one prefix

The fine print

Where anycast shines — and where it needs care

Anycast is powerful, not magic. It's a near-perfect fit for stateless, latency- sensitive services, with a few well-understood trade-offs worth knowing.

Great fit for

  • Stateless request/response protocols, such as DNS over UDP

    Each request can be answered independently, so a route change normally requires no shared session state. That's why all 13 DNS root identities run on anycast.

  • Short-lived or retry-friendly HTTP/S

    Routes are stable and many web requests are brief or safely retried, so CDNs serve HTTPS over anycast at scale — though HTTP/2, HTTP/3, WebSockets and streaming can be long-lived.

  • DDoS absorption

    Attack traffic is pulled toward nearby nodes selected by routing policy, so the flood splits across the network instead of hitting one target.

  • Failover with no new SPOF

    A heartbeat withdraws a dead node's route and BGP reconverges — automatic recovery without a central controller.

Handle with care

  • Long-lived connections can wobble

    A route change mid-connection can land packets on a PoP with no session state, resetting it — though published measurements put this well under 1 flow in 10,000 per hour (see sources).

  • Nearest isn't always fastest

    BGP selects a policy-preferred route based on factors like local preference, AS-path length, and traffic engineering — not real-time latency or congestion — so you don't fully control which PoP a user reaches.

  • The heartbeat is critical

    If a broken node keeps announcing, it becomes a black hole for nearby clients — the worst failure mode, and the withdrawal automation itself can fail.

  • Route hygiene is security

    Anyone whose announcements are accepted upstream could hijack the prefix — the same risk as any BGP route. Prefix filtering and RPKI route-origin validation help prevent invalid announcements, while TLS limits what an intercepted route can expose or impersonate.

Anycast in the wild

The internet already runs on this

Anycast isn't a lab trick — it quietly powers the DNS you resolve, the CDNs you download from, and the defenses that keep large sites online under attack.

Cloudflare — 1.1.1.1

Announces the same resolver IP from every data center. BGP hands each query to a policy-preferred nearby PoP, cutting round-trips for users almost anywhere.

330+ citiesone anycast IP, 125+ countries

DNS root servers

The 13 root identities (A–M) aren't 13 machines — each is an anycast cloud of servers mirroring the same address across the planet.

1,950+ instancesbehind 13 identities

Google Public DNS — 8.8.8.8

A recursive resolver reachable at one memorable IP worldwide. Anycast keeps lookups fast and the address online even if a site fails.

8.8.8.8same IP, every continent

DDoS mitigation

A flood aimed at one anycast IP is scattered across nearby PoPs selected by routing policy instead of one target — so the load is absorbed in parallel.

Split by regionno single chokepoint
FAQ

Anycast, answered

The short, plain-English version of everything this page shows in motion.

What is anycast?
Anycast is a network addressing and routing method in which a single IP address is shared by servers in multiple physical locations. Routers use Border Gateway Protocol (BGP) policy to deliver traffic toward a preferred available location announcing that address, which is often topologically nearby.
How does anycast work?
Every location — called a point of presence, or PoP — announces the exact same IP prefix into BGP. Because many places advertise the identical route, each network forwards traffic toward whichever announcement its routing policy prefers. If a PoP goes offline it withdraws its announcement, BGP reconverges, and traffic shifts to the next-preferred available PoP automatically.
What is the difference between anycast and unicast?
With unicast, an address is routed toward one network location — even if a load balancer or server cluster sits behind it. With anycast, the same address is announced from multiple locations at once, and the network routes each user toward a preferred available location. Anycast can therefore reduce latency and provide automatic failover, while a single unicast location remains a single point of failure.
What is anycast used for?
Anycast is widely used for DNS and content delivery. All 13 DNS root server identities are implemented as anycast clusters, public DNS resolvers such as Cloudflare's 1.1.1.1 and Google's 8.8.8.8 use anycast, and CDNs use it to route visitors toward a preferred nearby edge. It is also used to absorb DDoS attacks by spreading malicious traffic across multiple PoPs instead of one target.
Is anycast good for TCP and HTTPS?
Yes. Although anycast was historically associated with stateless request/response services such as DNS over UDP, internet routes are stable enough that long-lived TCP and HTTPS connections rarely break — measured flow interruptions are well under one flow per ten thousand per hour. Modern CDNs run HTTP and HTTPS over anycast at scale.
What is ECMP and how does it relate to anycast?
Equal-cost multi-path routing (ECMP) is one common way to distribute traffic for a single anycast IP across many servers inside one PoP. An edge router can hash each connection's packet headers to pick a server, and because the hash is consistent, packets in a given connection remain pinned to that server. Anycast selects the PoP; ECMP can spread the load across the machines within it.

Sources & further reading

Go deeper, straight from the source

Everything on this page is drawn from primary networking references. Here's where to read the standards, measurements, and operator experience for yourself.