Cloud data centers provide cost-effective and elastic resource management environments through multi-tenancy. However, we observe that existing policies cause unfair bandwidth allocation. A max-min based policy allocates lower bandwidth to a tenant whose the size of flows is mostly large, and DCTCP falls short of high utilization and minimum performance guarantee. Moreover, commodity clouds are vulnerable to denial of service (DoS) attacks, which can be attempted by a malicious tenant. The aforementioned deficiencies decrease the motivation to use clouds and revenue of cloud providers. To address the problem, we propose Spiderweb, a fair network sharing mechanism for cloud data centers, which allocates bandwidth to tenants in proportion to the amount of demand and payment during oversubscription. Our proposal delivers both a cloud-specialized fair network sharing environment and robustness against DoS attacks. We show that our proposal meets the desirable sharing properties including proportional fairness, performance isolation, and high utilization through analytical allocation scenarios.