# How the Coritan network works

> How traffic reaches your services over the Coritan network, from its points of presence to IPv6 and attack filtering.

Source: https://www.coritan.com/docs/platform/network/

In the dashboard:

- /network: https://www.coritan.com/network

Traffic reaches your services over the Coritan network in one of two ways, depending on the address it is sent to. Traffic to a floating IP enters at one of our points of presence, where DDoS Shield filters it. Traffic to the shared address of the machine a server runs on goes to that machine directly. The public [Network](https://www.coritan.com/network) page describes the network for buyers; this page explains what it means for the services you run.

## Terms

*Point of presence* (PoP)
: A Coritan site where our routers connect to the internet. A PoP announces our address ranges, filters the traffic it receives and passes the rest on to the machine your service runs on.

*Anycast*
: Announcing the same address range from more than one PoP. The internet delivers each packet to the PoP that its routing finds nearest, so traffic enters our network close to where it was sent from.

*Floating IP*
: A public address that belongs to your account and that you attach to an instance or a server ([Floating IPs](/docs/floating-ips/)). The address that comes with a Cloud Compute instance is a floating IP too.

*Shared address*
: The address of the machine a Container Apps server runs on. Every server on the machine uses it, each on ports of its own ([Manage server ports](/docs/managed-containers/ports/)).

## Traffic to a floating IP

Coritan announces the ranges its floating IPs come from at its points of presence. Traffic to one of them takes this path:

- It enters our network at a PoP that announces the address, usually the one nearest the sender.
- DDoS Shield filters it there, with the protection settings of that floating IP ([Change a floating IP's DDoS protection](/docs/floating-ips/shield-settings/)).
- What passes goes on to the machine that runs the instance or server the address is attached to.

Traffic your instance or server sends from a floating IP, replies included, leaves our network through the Coritan router nearest its machine, one in the same location when there is one. If the machine cannot reach a router, that traffic stops until it can, and it never leaves by another route.

When you move a floating IP to another instance or server, its traffic follows it to the new machine ([Attach and detach a floating IP](/docs/floating-ips/attach-and-detach/)).

## Traffic to a shared address

A server with no floating IP is reached on the shared address of its machine, at its own port. That traffic goes to the machine directly and does not pass through a PoP, so DDoS Shield does not filter it.

To put a server's traffic behind DDoS Shield, attach a floating IP to it. With a floating IP, the server can also take a game's default port, so players join with the address alone ([Manage server ports](/docs/managed-containers/ports/)).

## DNS

Coritan's nameservers, `ns1.coritan.com` to `ns8.coritan.com`, are anycast addresses too. A query for a zone we host enters at the nearest PoP and is answered in that PoP's region ([How DNS hosting works](/docs/websites/dns/)). A load balancer that places clients by **Answering PoP** uses that PoP as the client's location ([How DNS load balancing works](/docs/websites/load-balancing/)).

## IPv6

The addresses you order in the dashboard are IPv4: floating IPs, their subnets and the address that comes with an instance. The public Network page describes the network as dual-stack, but no service you order in the dashboard gets an IPv6 address. For IPv6 with a product you buy through sales, ask the sales team ([Bare metal, colocation and IP transit](/docs/platform/sales-led-products/)).

Other parts of Coritan take IPv6 addresses that you host elsewhere:

- A DNS zone can hold `AAAA` records ([DNS record types](/docs/websites/dns/record-types/)).
- A load balancer can send clients to IPv6 origins ([Create an origin pool](/docs/websites/load-balancing/create-an-origin-pool/)).
- An API key's allow-list can name IPv6 addresses and ranges ([Manage API keys](/docs/account/api-keys/)).

## Bandwidth

Each Cloud Compute plan includes a monthly traffic allowance, and the order page shows it with the plan ([How instance traffic is counted](/docs/cloud-compute/traffic/)).

## Your own addresses and connections

The dashboard has no page for BGP sessions, private peering, cross-connects or announcing your own address space. The Network page offers them under **Custom connectivity**, so ask the sales team ([Bare metal, colocation and IP transit](/docs/platform/sales-led-products/)).

## Limits

- DDoS Shield filters traffic to floating IPs. Traffic to a server's shared address does not pass through it.
- The addresses you order in the dashboard are IPv4 only.
- A floating IP comes from a pool in one region; choose one in the region where its instance or server runs ([IP pools and regions](/docs/floating-ips/pools/)).