§ whoami
whoami.
A read-only view of what your packet, your TLS handshake, and your HTTP headers reveal to the cloudflare edge — with a one-line note on what each field actually means and where it can mislead you.
rendered per request. refresh to re-evaluate.
§ origin
- ip
- 216.73.216.166
the address that opened the TCP socket to cloudflare. NAT, CGNAT, and corporate egress collapse here. behind a VPN this reflects the exit node, not your kernel.
- forwarded_for
- —
X-Forwarded-For chain. usually empty or echoes ip; populated when an upstream proxy added itself before reaching the edge.
- asn
- 16509
the autonomous system number announcing your /24 (or larger) into BGP. identifies your transit provider, not necessarily your eyeball ISP.
- organization
- Anthropic, PBC
the org name registered for that ASN in the regional registry.
- geo
- Columbus / Ohio / US
cloudflare's GeoIP guess. country is reliable; city is often off by tens of km, especially on mobile carriers.
- coords
- 39.96118, -82.99879
centroid of the geoip block, not your actual position. precision is not accuracy.
- timezone
- America/New_York
tz database name derived from the geoip city.
§ transport
- tcp_rtt
- 1 ms
kernel-reported smoothed RTT on the live TCP socket between you and the edge. this is the L4 floor for any HTTP timing you observe.
- tls_version
- TLSv1.3
protocol version negotiated in the ServerHello.
- tls_cipher
- AEAD-AES256-GCM-SHA384
AEAD suite negotiated for record encryption. on TLS 1.3, ciphers like AES_128_GCM_SHA256 and CHACHA20_POLY1305_SHA256 are the only options.
- http_protocol
- HTTP/2
application protocol layered on top. HTTP/3 means QUIC over UDP/443; HTTP/2 means TLS over TCP/443; HTTP/1.1 means one of the above without multiplexing.
- priority
- weight=16;exclusive=0;group=0;group-weight=0
HTTP/2 or HTTP/3 priority hints emitted by your client. urgency u=0..7 (lower=more urgent), incremental i=?1.
§ client
- user_agent
- Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
self-reported. trivially spoofed. modern chromium increasingly defers detail to client hints.
- accept_language
- —
q-weighted preference list. leaks your locale and often a regional dialect.
- accept_encoding
- gzip, br
compression algorithms your client will accept. zstd indicates a recent build; br is universal.
- sec_ch_ua
- —
low-entropy client hint (chromium only). platform and major version, with grease entries to discourage parsing.
- sec_ch_ua_platform
- —
OS family. firefox and safari do not send this.
- sec_ch_ua_mobile
- —
?0 or ?1.
- dnt
- —
do-not-track. universally ignored, but still emitted by some browsers.
§ edge
- colo
- CMH
the IATA code of the cloudflare PoP that terminated your TLS. anycast routes via BGP, not geography — you may not be at the closest one.
- continent
- NA
continent code from the GeoIP block.
- ray
- 9f904c51e9c5c465
unique request id. format is <hex>-<colo>; trailing colo agrees with the row above.
source: request.cf (cloudflare workers
IncomingRequestCfProperties) + request headers.