What is anycast, and why it makes your CDN faster
Anycast is one of those bits of networking magic that quietly makes the modern web fast. What it is, how it actually works, and the question everyone asks when they first hear about it.
Anycast lets many servers in many cities announce and share a single IP address. Internet routing then delivers each visitor's packets to whichever location is closest in network terms. The result is lower latency, failover that happens automatically within seconds, and attack traffic that spreads across the whole network instead of piling onto one machine.
Normally one IP address means one machine in one place. Anycast breaks that assumption in a genuinely useful way: the same address exists in dozens of locations simultaneously, and the internet's own routing decides which one you reach. The first time you hear it described, it sounds like it should not work.
What is anycast?
Anycast is a network addressing method where a single IP address is announced from multiple locations at once, and routers deliver traffic to whichever location is nearest by network path. The sender does nothing differently — it sends to one address, and the network resolves which copy answers.
The usual analogy is a national phone number for a chain of shops: you dial the same number from anywhere and reach your local branch, without looking anything up. It is a decent analogy for the effect, though it hides the mechanism, which is worth understanding because it explains the limitations.
How it actually works: BGP
The internet is not one network. It is around 75,000 independent networks — ISPs, hosting companies, universities, content providers — each identified by an autonomous system number, exchanging routing information with each other using the Border Gateway Protocol.
BGP is essentially a continuous conversation in which networks announce "I can reach these address ranges, and here is the path". Each router collects these announcements and, for any destination, picks the best available path by a set of rules that includes the number of networks the traffic must cross.
Anycast simply makes the same announcement from many places. A network in Copenhagen announces the range; so does one in Singapore; so does one in São Paulo. A router in Denmark hears all three announcements, sees that the Copenhagen path is shortest, and installs that route. A router in Malaysia does the same arithmetic and installs the Singapore route. Neither router knows or cares that the others exist.
Note what "nearest" means here: fewest network hops and best routing policy, not fewest kilometres. Usually those coincide. Occasionally they do not — a visitor may be routed to a city further away because that is where their ISP's peering happens to be. It is a real effect, and the reason anycast and geographic routing sometimes disagree.
"But does that not break TCP?"
This is the first question anyone with networking experience asks, and it is a good one. TCP connections are stateful. If packet one arrives at Copenhagen and packet two arrives at Frankfurt, the Frankfurt server has no idea what the connection is and resets it. So why does anycast work at all?
Because BGP routes are stable on the timescale of a web request. Routing tables do change, but not thousands of times a second — a given router's chosen path for a given prefix typically holds for minutes or hours. A TCP connection lasting a few seconds will almost always spend its whole life talking to the same location.
Almost always is not always, and the cases where it breaks are real: a routing change mid-connection sends the remaining packets somewhere else and the connection dies. On the open internet this is rare enough to be a rounding error, and the browser simply reconnects. QUIC improves on this further, since it identifies connections by a connection ID rather than by the IP and port tuple, so it can survive being handed to a different path more gracefully than TCP can.
Three things it buys you
Failover without DNS
This is the quiet superpower. If an anycast location goes down, it stops announcing the route, neighbouring routers withdraw it, and traffic converges on the next-nearest location — typically within seconds, with nobody editing a DNS record and no cached answer pointing at a dead server.
Compare that with DNS-based failover, where the speed of recovery is capped by your TTL and by resolvers that ignore it. A 300-second TTL means five minutes of some visitors being sent to a machine that is not there.
DDoS defence by geometry
A botnet attacking an anycast address does not get to choose which location it hits. Each bot's traffic is routed to the location nearest to that bot, so a globally distributed attack divides itself across a globally distributed network automatically. An attack that would saturate one site arrives as a fraction of that at fifty. No configuration is involved — it is a property of how the addressing works.
Where anycast is not the answer
Two honest limitations.
You need address space and BGP. Running anycast requires your own IP ranges, an autonomous system number, and BGP sessions with transit providers and peers at every location. That is not a weekend project, which is why anycast is something you get from a provider rather than something you switch on.
You get less control. With GeoDNS you can decide that Portuguese visitors should reach a particular server, for any reason you like — capacity, licensing, compliance. With anycast, routing decides, and routing is the aggregate of policies set by thousands of networks you have no relationship with. When you need deterministic control over who lands where, that is a real drawback. Which is why plenty of networks use both.
Frequently asked questions
What is anycast?
Anycast is a network addressing method in which a single IP address is announced from multiple physical locations simultaneously, and internet routing delivers each sender's traffic to whichever location is nearest along the network path. The sender uses one address and is unaware that several servers share it.
How does anycast work?
Through BGP, the protocol networks use to exchange routing information. Each anycast location announces the same address range to its neighbours, and every router on the internet independently selects the shortest available path to that range. A router in Europe therefore installs a route to the European location while a router in Asia installs one to the Asian location, without either being coordinated.
Does anycast break TCP connections?
Very rarely. TCP requires all packets in a connection to reach the same server, and anycast works because BGP routes are stable over minutes or hours rather than changing constantly, so a short-lived web connection almost always stays with one location. A routing change mid-connection can break it, at which point the browser reconnects. QUIC handles this better than TCP, since it identifies connections by a connection ID rather than by IP and port.
What is the difference between anycast and unicast?
Unicast is the normal case: one IP address corresponds to one interface on one machine, and traffic to it has exactly one destination. Anycast assigns the same address to many machines in different locations, so traffic reaches whichever is nearest by network path. Unicast is one-to-one; anycast is one-to-nearest-of-many.
Does anycast help against DDoS attacks?
Yes, structurally. Because each attacking machine's traffic is routed to the anycast location nearest to it, a globally distributed botnet automatically distributes its attack across every location in the network rather than concentrating it on one. This requires no configuration — it follows from how anycast routing works — and means the total capacity resisting the attack is the whole network's, not one site's.
Can I set up anycast myself?
Only with significant infrastructure. It requires your own allocated IP address ranges, an autonomous system number, and BGP sessions established with transit providers or internet exchanges at every location you want to announce from. For almost all websites, anycast is a property of the CDN or DNS provider you choose rather than something you deploy yourself.
The elegance of anycast is that it does not add a layer. It uses the routing that already exists and would be running anyway, and gets locality, failover and attack distribution as consequences of a single decision about how to announce an address.
See how NordicCDN does this for your site:
Mads has worked in IT — mostly hosting — since he was 16. He took an early stake in a SaaS company and helped grow it through to its acquisition by Visma, has built and run data-center networks, and served as CTO of a Danish data center. He started NordicCDN to make fast, secure infrastructure simple to use.
