RADAR checks that an organization’s DDoS protection is effective in action, without disrupting production. To do this safely, RADAR uses a monitor to confirm that the customer’s Target stays responsive. If monitoring traffic is blocked, RADAR is unable to validate the Target’s availability, which means it can’t confirm that the protection is working as intended. This page explains how to identify and verify the RADAR monitor.
Why RADAR Uses Monitors
RADAR runs DDoS simulations against live production environments, it must always know how the Target is responding. Before a simulation starts, the monitor measures the Target’s normal response time and uses it as a baseline. During the simulation, it keeps tracking the Target’s responsiveness. If the response time deviates from the expected range, RADAR stops the simulation automatically. This is how RADAR keeps every test nondisruptive to the customer’s service. RADAR supports several monitor types for different kinds of services.
For Targets protected by Cloudflare, RADAR uses only one dedicated monitor, operated directly by MazeBolt. It sends requests only to Targets that a RADAR customer has added to their own environment, and only after domain ownership has been verified and contractual authorization is in place. Each check is a single HTTPS request over port 443.
How to Identify and Verify the Monitor
- User-Agent: MazeBolt Verified Bot Monitor
- Headers: Every request is signed using Web Bot Auth and includes the Signature, Signature-Input, and Signature-Agent headers.
- Signature-Agent: Each request’s signature can be verified against the public keys published in MazeBolt’s key directory: webbotauth.ops-boltlabs.com
- Requests that claim to be the RADAR monitor but fail these checks do not come from MazeBolt.
- Rate: The monitor sends traffic in two scenarios: routine monitoring, at one request every 15 seconds, and during a simulation, at two requests per second. These rates apply per monitoring node.
Data Use
The monitor records only the response time and response status of each request.
The response body is never stored, indexed, or cached. No data is Collected data or used for any purpose other than showing the customer their Target’s availability.