利用循环DNS均衡Web负载

拥有一个人人都想造访的web站点当然是件好事,但是每天呈指数增长的访问次数可能会使站点管理者对服务器的过载忧心忡忡。当一台Web服务器出现过载时,显而易见的解决方案是再增加一台服务器使负载分流,困难在于如何在不为该站点增加第二个URL的情况下在一台以上的web服务器之间分配Web站点访问击入次数。有许多种途径可以扩展Web站点的主机数量,包括使用负载平衡软件或者专用路由器,还有一种更简单的解决方案是利用DNS(域名系统)的循环DNS功能。循环DNS能够对同一主机名指代多台主机进行识别,与向每一个DNS分析请求提供同一主机IP地址不同,循环DNS在其对IP地址请求的应答中将主机的次序加以循环,从而在所有主机间分配负载。     

端口重定向后透明代理的实现

本文主要介绍在代理服务器上使用Linux2.4内核的iptables进行端口重定向以后,代理服务器如何取得用户请求的目的IP地址和目的端口号,从而实现透明代理. 1透明代理 代理服务是指由一台拥有标准IP地址的机器代替若干没有标准IP地址的机器和Internet上的其它主机连接,提供代理服务的这台机器称为代理服务器.拥有内部地址的机器想连接到Internet上时,先把这个请求发送给拥有标准IP地址的代理服务器,由代理服务器把这个请求通过它的标准IP地址发到请求的目的地址.然后目标地址的服务器把返回的结果发回给代理服务器,代理服务器再原封不动地把资料发给内部主机.若干拥有内部地址的机器组成了内部网,代理服务器的作用就是沟通内部网和Internet,解决内部网访问Internet的问题.     

基于AHP的Web集群系统负载均衡算法

利用集群技术构建的服务器组在资源利用率上存在较大差异。为此,提出基于层次分析法(AHP)的集群系统负载均衡算法,建立判断矩阵,得到各项评估指标的单项和综合权重。调度器定时接收真实服务器上的4类参数：网络性能,服务器硬件,服务器软件和网络服务类型。根据调度器收到的每一个连接请求,采用动态反馈算法选择负载最小的服务器响应连接请求。实验结果表明,该算法能减少服务器平均响应时间,有效提高集群系统的响应率。     

基于高可用性的动态漂移技术研究

本文分析了用以提高服务可用性的动态漂移技术的各种实现方法，包括DNS轮转、HTTP报文重定向、IP报文重定向、IP欺骗以及新近提出的连接迁移技术，并着重对连接迁移技术的运行机理进行了深入阐述。文章最后从性能方面对以上方法作了比较。     

Web集群系统的负载均衡算法

采用集群技术搭建所需的服务器往往导致各服务器系统资源利用率存在很大差距。为解决上述问题,通过分析已有的负载均衡算法,提出一种改进的动态反馈负载均衡算法。调度器定时接收集群中每台服务器上报的性能参数,计算每台服务器当前负载比例值,根据该值计算每台服务器的分发权重,以合理分配用户请求。实验结果证明该算法能有效提高集群系统的整体性能。     

一种复合式的负载均衡方案探究

负载均衡技术可减轻大数据量的处理需求给服务器集群带来的巨大压力。本文对现有负载均衡技术和Linux服务器集群算法进行了分析,并依此为基础,探讨一种复合式的负载均衡方案。该方案融合了基于请求内容和IP隧道的负载均衡的优点,采用客户端和旁路负载均衡器相配合的结构,可进一步提高集群性能,提高资源利用率。     

并行WWW服务器集群请求分配算法的研究

为了有效地提高WWW服务器的吞吐能力、反应速度和可扩展性,国际上许多繁忙站点纷纷转向采用并行WWW服务器集群来替代原有的单一主机服务器.这些站点普遍采用请求分配技术,即集中接收所有到达的HTTP请求,然后“均衡”地分配到集群中的各个服务器进行处理.常用的转轮法、最少连接法和最快连接法等算法在分配请求时,要么对集群中各个服务器的性能不加区分,要么不考虑请求的具体内容,在实际系统中效率较低.文章提出了一种适用于异构集群的局部最优请求分配算法（least time increment,简称LTI）,综合考虑服务     

基于RR-DNS的Web集群系统的可用性研究

RR-DNS(Round-Robin DNS)是指循环式域名服务。文中提出一个利用原有RR-DNS提高Web集群系统可用性的机制。这种机制可以定期监测各个服务器,判断每个服务器是否能正常工作,对有问题的服务器立即更改DNS服务器的设定来避免用户对有问题的服务器进行访问。通过维护的DNS主机列表不仅可以为多台服务器提供负载均衡,同时也提高了服务器的可用性。     

基于软件定义网络的反饱和分组云负载均衡

云计算中统计复用是其显著特点,通过使用虚拟化技术可以提高物理资源利用率。针对云虚拟机集群需要考虑资源利用的负载均衡问题,面向OpenStack云平台,提出基于软件定义网络(SDN)的反饱和分组负载均衡(ASGS)方法。云主机按权值分配到不同的分组,SDN控制器利用探针根据不同分组周期性获取云主机负载。当请求到来时,均衡器以每组云主机平均权值为概率,随机选择一组,并在组内通过轮询选择一台合适的后端。为避免某台后端出现突发请求利用资源过多造成的云主机宕机现象,对较高权值的云主机预先加上一个参数,增高权值,使其处于高负载状态,让其接收更少的请求。实验结果表明,所提算法使各云主机不管请求量如何变化,随着时间的变化集群中云主机的资源利用率的标准方差比随机和轮询波动更小,更趋近于0,使得云主机集群的负载更均衡。     

基于RR—DNS的Web集群系统的可用性研究

RR-DNS(Round-Robin DNS)是指循环式域名服务.文中提出一个利用原有RR-DNS提高Web集群系统可用性的机制.这种机制可以定期监测各个服务器,判断每个服务器是否能正常工作,对有问题的服务器立即更改DNS服务器的设定来避免用户对有问题的服务器进行访问.通过维护的DNS主机列表不仅可以为多台服务器提供负载均衡,同时也提高了服务器的可用性.     

A collaborative defense mechanism against SYN flooding attacks in IP networks

SYN flooding exploits the Transmission Control Protocol (TCP) three-way handshake process by sending many connection requests using spoofed source IP addresses to a victim's host. This keeps that host from handling legitimate requests, causing it to populate its backlog queue with forged TCP connections. In this article, we propose a novel defense mechanism that makes use of the edge routers that are associated with the spoofed IP addresses’ networks to determine whether the incoming SYN–ACK segment is valid. This is accomplished by maintaining a matching table of the outgoing SYNs and incoming SYN–ACKs and also by using the ARP protocol. If an incoming SYN–ACK segment is not valid, the edge router resets the connection at the victim's host, freeing up an entry in the victim's backlog queue, and enabling it to accept other legitimate incoming connection requests. We also present a communication protocol to encourage collaboration between various networks to protect each other. We evaluated the performance of our proposed approach and studied its impact on the network. Our experimental and simulation results showed the efficiency of our proposed collaborative defense mechanism.     

High performance mobility without agent infrastructure for connection oriented service

Currently it is very difficult for connection oriented applications to use a mobile environment. One reason is that Mobile IP requires intermediate software agents to be deployed in the Internet. This infrastructure based mobility scheme offers connectivity to itinerant hosts but incurs significant handoff and tunneling delays along with deployment costs. These delays are particularly harmful for connection oriented applications. In this paper we investigate an alternate mobility scheme which does not require any such infrastructure but only uses an end-point technique and interestingly provides much faster loss-free handoff for connection oriented applications. This End-to-End scheme named Interactive Protocol for Mobile Networks (IPMN) intelligently performs handoff based on information provided by MAC Layer. The network address change is handled by renewing the existing connections by manipulating the TCP/IP stack at the end-points. Also, unlike several other recently proposed end-to-end techniques which require extensive modification of end-protocols, the proposed scheme does not require any functional change in the TCP/IP protocol software. Besides the difference in deployment scenarios, the IPMN offers blazingly fast event based handoff and much faster and simplified transport (no tunneling delay) than MIP. We have implemented IPMN over FreeBSD. In this paper we show the performance advantage of IPMN over MIP with real deployment for three interesting real-time traffic types — www, voice streaming and, steerable/interactive time critical video.     

IP-in-IP tunneling to enable the simultaneous use of multiple IP interfaces for network level connection striping

With ubiquitous computing and network access now a reality, multiple network conduits are become widely available to mobile as well as static hosts: for instance wired connections, 802.11 style wireless LANs, Bluetooth, and cellular phone modems. Selection of the preferred mode of data transfer is a dynamic optimization problem which depends on the type of application, its bandwidth/latency/jitter requirements, current network conditions (such as congestion or traffic patterns), cost, power consumption, battery life, and so on. Furthermore, since wireless bandwidth is likely to remain a scarce resource, we foresee scenarios wherein mobile hosts will require simultaneous data transfer across multiple IP interfaces to obtain higher overall bandwidth.We present a brief overview of existing work which enables the simultaneous use of multiple network interfaces and identify the applicability as well as strengths and weaknesses of these related approaches. We then propose a new mechanism to aggregate the bandwidth of multiple IP paths by splitting a data flow across multiple network interfaces at the IP level. We have analyzed the performance characteristics of our aggregation scheme and demonstrate significant gains when the network paths being aggregated have similar bandwidth and latency characteristics. In addition, our method is transparent to transport (TCP/UDP) and higher layers, and allows the use of multiple network interfaces to enhance reliability. Our analysis identifies the conditions under which the proposed scheme, or any other scheme that stripes a single TCP connection across multiple IP paths, can be used to increase throughput.     

基于嵌入式系统的TCP/IP协议栈的实现

描述了一种可移植的、无须操作系统支持、以软件实现的非路由器TCP／lP原型的实现。该TCP／IP原型基于某种小型嵌入式系统。依据RFC 1122兼容性规定，提供IP、ARP、TCP、UDP服务和Berkeleysocket编程接口。     

DHCP服务在路由器与交换机上的配置应用

在Internet中,主机之间通过IP地址相互通信,因此分配、管理、设置客户端IP地址的工作尤为重要。网络管理员手工方式设置IP地址,不仅非常费力、费时,而且也容易出错,尤其在大中型网络系统中,手工设置IP地址更是一项非常复杂的工作。文章阐述了利用DHCP服务器为客户端主机自动分配IP地址等相关信息的配置方法。有效提高网络管理员的工作效率。     

基于TCP／IP协议多客户连接的服务端程序实现

介绍了C／S架构中普遍采用的TCP／IP协议,以及运用该协议进行数据传输的网络通信机制,讨论了利用SOCKET套接字实现TCP传输控制协议的编程机理,重点剖析在VC＋＋开发平台上使用WinSocket API实现Socket套接字的系统调用方法,从而成功实现了基于TCP/IP协议的、多客户连接的服务器端程序的开发。     

Transparent VPN failure recovery with virtualization

Cloud computing is widely used to provide today’s Internet services. Since its service scope is being extended to a wide range of business applications, the security of network communications between clients and clouds are becoming important. Several cloud vendors support virtual private networks (VPNs) for connecting their clouds. Unfortunately, cloud services become unavailable when a VPN failure occurred in a VPN gateway or networks. We propose a transparent VPN failure recovery scheme that can hide VPN failures from users and operating systems (OSs). This scheme transparently recovers from VPN failures by establishing VPN connections in a virtualization layer. When a VPN failure occurs, a client virtual machine monitor (VMM) automatically reconnects to an available VPN gateway which is geographically distributed and connected via leased lines in clouds. IP address changes are hidden from client OSs and servers via a packet relay system implemented by a relay client in the client VMM and a relay server. We implemented a prototype system based on BitVisor, a small client VMM supporting IPsec VPN, and evaluated the prototype system in a wide-area distributed Internet environment in Japan. Experimental results show that our scheme can maintain TCP connections on VPN failures, and performance overhead with the virtualization layer is around 0.6 ms to latency and 8%-30% to throughput.     

基于Netfilter的连接限制的研究与实现

提出一种限制连接的方法。利用Netfilter／Iptables系统的扩展功能,创建一个可以对TCP和UDP连接数分别进行限制的Netfilter／Iptables模块。在该模块中,TCP连接限制算法利用了TCP连接的特性,而UDP连接限制算法利用了计时的方法。使用该模块可以方便有效地控制客户端的并发连接数。     

基于主动TCP连接复制的高性能高可用MySQL数据库集群

提出一种基于主动TCP连接复制的高性能高可用MySQL数据库集群解决方案．该方案采用集群技术对并发的多个TCP连接进行原子多播转换和复制以达到连接容错的效果,同时,对连接流中的只读操作进行分流以达到提高性能的目的．该方案将对TCP连接进行复制的技术应用于MySQL数据库集群中,从而实现了数据库集群整体的高可用性和高性能．经过原型系统的实现和测试,证明了该方案在复制过程中对数据库写操作造成了较小的性能损耗,同时极大地提高了数据库集群的只读查询性能．     

基于以太网的FAST主动反射面控制系统的开发

针对FAST(Five-hundred-meterApretureSphericalTelescope,500米口径球面射电望远镜)主动反射面自身的特点,提出了主动反射面促动器运动控制的总体策略,设计了基于以太网和TCP(UDP)/IP协议的控制方案。Arm芯片作为控制器,嵌入实时的操作系统μcosII和TCP(UDP)/IP通讯协议栈,提供控制和通讯的平台。在VC++6.0环境下实现监控机的通讯程序和控制界面,并且完成了两个促动器控制系统的样机制造和试验。