Cloudflare Mesh, Cloudflare Tunnel, Cloudflare One, Gateway, Workers VPC - Identify Mesh, Workers VPC, and Cloudflare Tunnel replicas in network logs

<p>You can now tell a person on a laptop apart from a Mesh node or an AI agent running on Workers, without matching on connector email addresses or Mesh IP ranges — and see exactly which Cloudflare Tunnel and <code>cloudflared</code> replica received each session.</p> <p><a href="https://developers.cloudflare.com/cloudflare-one/insights/logs/dashboard-logs/gateway-logs/#network-logs">Gateway network logs</a> and <a href="https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/">Zero Trust Network Session Logs</a> now identify two new kinds of traffic:</p> <ul> <li><strong>Mesh</strong> — Traffic sent from or delivered to a <a href="https://developers.cloudflare.com/mesh/">Cloudflare Mesh</a> node. Previously, Mesh nodes were logged the same way as devices running the <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/devices/cloudflare-one-client/">Cloudflare One Client</a>, because Mesh nodes run the client in headless mode.</li> <li><strong>Workers VPC</strong> — Traffic sent by a Worker through a <a href="https://developers.cloudflare.com/workers-vpc/">Workers VPC</a> binding. Previously, Workers VPC sessions were not recorded in Network Session Logs.</li> </ul> <img src="https://developers.cloudflare.com/cdn-cgi/image/onerror=redirect,width=1439,height=796,format=webp/_astro/2026-09-28-mesh-workers-vpc-network-logs.iGvLKYk7.gif" alt="Viewing Mesh and Workers VPC traffic in Gateway network logs" loading="lazy" decoding="async" width="1439" height="796"> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="gateway-network-logs">Gateway network logs</h4><a class="anchor-link" href="#gateway-network-logs"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>To view these values in the dashboard, go to <strong>Zero Trust</strong> &gt; <strong>Insights &amp; Logs</strong> &gt; <strong>Logs</strong> &gt; <strong>Network logs</strong>, select <strong>Columns</strong>, and turn on <strong>Traffic Source</strong> and <strong>Traffic Destination</strong>. Both values also appear under <strong>Network query details</strong> when you open a log entry.</p> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="network-session-logs">Network Session Logs</h4><a class="anchor-link" href="#network-session-logs"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>The <code>zero_trust_network_sessions</code> dataset, available through <a href="https://developers.cloudflare.com/cloudflare-one/insights/logs/logpush/">Logpush</a>, includes the following fields:</p> <div class="table-scroll" tabindex="0" role="region" aria-label="Table"><table> <thead> <tr> <th>Field</th> <th>Description</th> </tr> </thead> <tbody> <tr> <td><code>OnrampType</code></td> <td>How the session entered Cloudflare One. Values: <code>CF1_CLIENT</code>, <code>MESH</code>, <code>WORKERS_VPC</code>, <code>MAGIC</code>, <code>OTHER</code>.</td> </tr> <tr> <td><code>Offramp</code></td> <td>Where the session was routed. Sessions routed to a Mesh node report <code>MESH</code>.</td> </tr> <tr> <td><code>SourceName</code></td> <td>Name of the Worker that started the session. Only populated for Workers VPC sessions.</td> </tr> <tr> <td><code>SourceID</code></td> <td>Stable identifier of the Worker that started the session. Only populated for Workers VPC sessions.</td> </tr> <tr> <td><code>DestinationReplicaID</code></td> <td>The replica that served the session, such as a specific replica of a Mesh node or a <code>cloudflared</code> replica of a Cloudflare Tunnel.</td> </tr> </tbody> </table></div> <p>For example, <code>OnrampType = 'WORKERS_VPC' AND Offramp = 'MESH'</code> returns every session where a Worker reached a service behind a Mesh node, and <code>SourceName</code> tells you which Worker it was.</p> <aside role="note" aria-label="Redeploy your Workers" class="aside-card flex items-start gap-3 rounded-lg px-4 py-3 my-4" style="--_c: var(--nb-warning); --_t: var(--nb-warning-muted);" data-astro-cid-znle5jil><span class="flex h-[1.375em] shrink-0 items-center" aria-hidden="true" data-astro-cid-znle5jil><svg width="1em" height="1em" viewBox="0 0 256 256" class="h-[1em] w-[1em]" data-astro-cid-znle5jil="true" data-icon="ph:warning"><path fill="currentColor" d="M236.8 188.09L149.35 36.22a24.76 24.76 0 0 0-42.7 0L19.2 188.09a23.51 23.51 0 0 0 0 23.72A24.35 24.35 0 0 0 40.55 224h174.9a24.35 24.35 0 0 0 21.33-12.19a23.51 23.51 0 0 0 .02-23.72m-13.87 15.71a8.5 8.5 0 0 1-7.48 4.2H40.55a8.5 8.5 0 0 1-7.48-4.2a7.59 7.59 0 0 1 0-7.72l87.45-151.87a8.75 8.75 0 0 1 15 0l87.45 151.87a7.59 7.59 0 0 1-.04 7.72M120 144v-40a8 8 0 0 1 16 0v40a8 8 0 0 1-16 0m20 36a12 12 0 1 1-12-12a12 12 0 0 1 12 12"/></svg></span><div class="flex min-w-0 flex-1 flex-col gap-0.5" data-astro-cid-znle5jil><p class="m-0 text-base leading-snug font-semibold" data-astro-cid-znle5jil>Redeploy your Workers</p><div class="aside-card-body text-sm leading-normal" data-astro-cid-znle5jil><p><code>SourceName</code> and <code>SourceID</code> are only populated for Workers deployed after 29 September 2026. To include them for an existing Worker, redeploy it — for example, with <code>npx wrangler deploy</code>. No code changes are required.</p></div></div></aside> <div tabindex="-1" class="heading-wrapper level-h4"><h4 id="see-which-tunnel-and-replica-received-a-session">See which tunnel and replica received a session</h4><a class="anchor-link" href="#see-which-tunnel-and-replica-received-a-session"><span aria-hidden="true" class="anchor-icon"><svg width="16" height="16" viewBox="0 0 24 24"><path fill="currentcolor" d="m12.11 15.39-3.88 3.88a2.52 2.52 0 0 1-3.5 0 2.47 2.47 0 0 1 0-3.5l3.88-3.88a1 1 0 0 0-1.42-1.42l-3.88 3.89a4.48 4.48 0 0 0 6.33 6.33l3.89-3.88a1 1 0 1 0-1.42-1.42Zm8.58-12.08a4.49 4.49 0 0 0-6.33 0l-3.89 3.88a1 1 0 0 0 1.42 1.42l3.88-3.88a2.52 2.52 0 0 1 3.5 0 2.47 2.47 0 0 1 0 3.5l-3.88 3.88a1 1 0 1 0 1.42 1.42l3.88-3.89a4.49 4.49 0 0 0 0-6.33ZM8.83 15.17a1 1 0 0 0 1.1.22 1 1 0 0 0 .32-.22l4.92-4.92a1 1 0 0 0-1.42-1.42l-4.92 4.92a1 1 0 0 0 0 1.42Z"></path></svg></span></a></div> <p>With <code>DestinationReplicaID</code>, you can now confirm which <a href="https://developers.cloudflare.com/tunnel/">Cloudflare Tunnel</a> and which <code>cloudflared</code> replica received traffic for a specific session. Combine it with the existing <code>DestinationTunnelID</code> field to trace a session to an exact tunnel replica — or Mesh node replica — when you run multiple replicas for high availability. The replica ID matches the <strong>Connector ID</strong> shown in the dashboard, so you can <a href="https://developers.cloudflare.com/tunnel/observability/#remote-log-streaming">stream that replica's logs</a> with <code>cloudflared tail --connector-id</code>.</p> <p>Sessions logged before this change are not backfilled. For all available fields, refer to <a href="https://developers.cloudflare.com/logs/logpush/logpush-job/datasets/account/zero_trust_network_sessions/">Zero Trust Network Session Logs</a>.</p>