each service in a computer network may have a connection rate limit. The number of new connections per time period may be limited by using a series of rules. In a specific embodiment of the present invention, a counter is increased each time a server is selected to handle a connection request. For each service, connections coming in are tracked. Therefore, the source of connection-request packets need not be examined. Only the destination service is important. This saves significant time in the examination of the incoming requests. each service may have its own set of rules to best handle the new traffic for its particular situation. For server load balancing, a reset may be sent to the source address of the new connection request. For transparent cache switching, the connection request may be forwarded to the Internet.

Patent
   7774482
Priority
May 03 2002
Filed
May 03 2002
Issued
Aug 10 2010
Expiry
May 28 2024
Extension
756 days
Assg.orig
Entity
unknown
0
34
EXPIRED
1. A computer implemented method comprising:
incrementing a counter each time a new server load balancing service connection request is received, the request identifying a source of the request, the request further identifying a destination server load balancing service, the server load balancing service connection request comprising a request to connect to a server load balancing service;
directing the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the counter increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
granting the new server load balancing service request if the counter has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
35. A computer implemented method comprising:
incrementing a number each time a new server load balancing service connection request is received, the request identifying a source address of the request, the request further identifying a destination server load balancing service, the server load balancing service connection request comprising a request to connect to a server load balancing service;
directing the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the number increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
granting the new server load balancing service request if the number has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
11. An apparatus comprising:
means for incrementing a counter each time a new server load balancing service connection request is received, the request identifying a source of the request, the request further identifying a destination server load balancing service, the server load balancing service connection request comprising a request to connect to a server load balancing service;
means for directing the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the counter increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
means for granting the new server load balancing service request if the counter has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
44. An apparatus comprising:
means for incrementing a number each time a new server load balancing service connection request is received, the request identifying a source address of the request, the request further identifying a destination server load balancing service, the server load balancing service connection request comprising a request to connect to a server load balancing service;
means for directing the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the number increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
means for granting the new server load balancing service request if the number has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
56. An apparatus comprising:
a memory;
a new server load balancing service connection request counter incrementer coupled to the memory and configured to increment a number each time a new server load balancing service connection request comprising a request to connect to a server load balancing service is received, the request identifying a source address of the request, the request further identifying a destination server load balancing service, the apparatus further configured to:
direct the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the number increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
grant the new server load balancing service request if the number has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
18. A non-transitory program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method, the method comprising:
incrementing a counter each time a new server load balancing service connection request is received, the request identifying a source of the request, the request further identifying a destination server load balancing service, the server load balancing service connection request comprising a request to connect to a server load balancing service;
directing the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the counter increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
granting the new server load balancing service request if the counter has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
50. A non-transitory program storage device readable by a machine, embodying a program of instructions executable by the machine to perform a method, the method comprising:
incrementing a number each time a new server load balancing service connection request is received, the request identifying a source address of the request, the request further identifying a destination server load balancing service, the server load balancing service connection request comprising a request to connect to a server load balancing service;
directing the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the number increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
granting the new server load balancing service request if the number has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
25. An apparatus comprising:
a memory;
a new server load balancing service connection request counter incrementer coupled to the memory and configured to increment a counter each time a new server load balancing service connection request comprising a request to connect to a server load balancing service is received, the request identifying a source of the request, the request further identifying a destination server load balancing service, the server load balancing service connection request comprising a request to connect to a server load balancing service; and
a new server load balancing service connection request source address reset sender coupled to the new server load balancing service connection request counter incrementer and to the memory and configured to:
direct the new server load balancing service connection request to a particular one of a plurality of servers of the server load balancing service based at least in part on a predetermined scheme, if the counter increases at a rate exceeding a predetermined server load balancing service connection rate limit, the particular one of the plurality of servers configured to further direct the request to another one of the plurality of servers to process the request; and
grant the new server load balancing service request if the counter has not increased at a rate exceeding the predetermined server load balancing service connection rate limit.
2. The method of claim 1, further including resetting the counter to zero if the elapsed time since the last counter reset is greater than a predetermined time interval.
3. The method of claim 2, wherein the predetermined server load balancing service connection rate limit is a number of transactions per predetermined time interval.
4. The method of claim 1, further comprising detecting a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
5. The method of claim 1 wherein the incrementing further comprises incrementing the counter without examining the source address.
6. The method of claim 1 wherein the incrementing is based at least in part on the identification of the destination server load balancing service.
7. The method of claim 1, further comprising detecting a new server load balancing service connection request by looking for any user datagram protocol (UDP) packets.
8. The method of claim 1 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers having a least number of connections.
9. The method of claim 1 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a round robin approach.
10. The method of claim 1 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a weighted approach.
12. The apparatus of claim 11, further including means for resetting the counter to zero if the elapsed time since the last counter reset is greater than a predetermined time interval.
13. The apparatus of claim 12, wherein the predetermined server load balancing service connection rate limit is a number of transactions per predetermined time interval.
14. The apparatus of claim 11, further comprising means for detecting a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
15. The apparatus of claim 11 wherein the means for incrementing a counter each time a new server load balancing service connection request is received further comprises means for incrementing the counter without examining the source address.
16. The apparatus of claim 11 wherein the means for incrementing further comprises means for incrementing the counter based at least in part on the identification of the destination server load balancing service.
17. The apparatus of claim 11 further comprising means for detecting a new connection request for the service on the server by looking for any user datagram protocol (UDP) packets.
19. The program storage device of claim 18, the method further including resetting the counter to zero if the elapsed time since the last counter reset is greater than a predetermined time interval.
20. The program storage device of claim 19, wherein the predetermined server load balancing service connection rate limit is a number of transactions per predetermined time interval.
21. The program storage device of claim 18, the method further comprising detecting a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
22. The program storage device of claim 18 wherein the incrementing further comprises incrementing the counter without examining the source address.
23. The program storage device of claim 18 wherein the incrementing is based at least in part on the identification of the destination server load balancing service.
24. The program storage device of claim 18, the method further comprising detecting a new server load balancing service connection request by looking for any user datagram protocol (UDP) packets without a session.
26. The apparatus of claim 25 wherein the apparatus is further configured to reset the counter to zero if the elapsed time since the last counter reset is greater than a predetermined time interval.
27. The apparatus of claim 26 wherein the predetermined server load balancing service connection rate limit is a number of transactions per predetermined time interval.
28. The apparatus of claim 25 wherein the apparatus is further configured to detect a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
29. The apparatus of claim 25 wherein the apparatus is further configured to incrementing the counter without examining the source address.
30. The apparatus of claim 25 wherein the new server load balancing service connection request counter incrementer is further configured to increment the counter based at least in part on the identification of the destination server load balancing service.
31. The apparatus of claim 25, wherein the new server load balancing service connection request detector comprises a user datagram protocol packet session examiner.
32. The apparatus of claim 25 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers having a least number of connections.
33. The apparatus of claim 25 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a round robin approach.
34. The apparatus of claim 25 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a weighted approach.
36. The method of claim 35, further comprising resetting the number to zero if the elapsed time since the last number reset is greater than a predetermined time interval.
37. The method of claim 35, wherein the predetermined connection rate limit is a number of transactions per predetermined time interval.
38. The method of claim 35, further comprising detecting a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
39. The method of claim 35 wherein the incrementing is based at least in part on the identification of the destination server load balancing service.
40. The method of claim 35, further comprising detecting a new server load balancing service connection request by looking for any user datagram protocol (UDP) packets.
41. The method of claim 35 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers having a least number of connections.
42. The method of claim 35 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a round robin approach.
43. The method of claim 35 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a weighted approach.
45. The apparatus of claim 44, further comprising means for resetting the number to zero if the elapsed time since the last number reset is greater than a predetermined time interval.
46. The apparatus of claim 44, wherein the predetermined connection rate limit is a number of transactions per predetermined time interval.
47. The apparatus of claim 44, further comprising means for detecting a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
48. The apparatus of claim 44 wherein the incrementing is based at least in part on the identification of the destination server load balancing service.
49. The apparatus of claim 44, further comprising means for detecting a new server load balancing service connection request by looking for any user datagram protocol (UDP) packets without a session.
51. The program storage device of claim 50, the method further comprising resetting the number to zero if the elapsed time since the last number reset is greater than a predetermined time interval.
52. The program storage device of claim 50, wherein the predetermined connection rate limit is a number of transactions per predetermined time interval.
53. The program storage device of claim 50, the method further comprising detecting a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
54. The program storage device of claim 50 wherein the incrementing is based at least in part on the identification of the destination server load balancing service.
55. The program storage device of claim 50, the method further comprising detecting a new server load balancing service connection request by looking for any user datagram protocol (UDP) packets.
57. The apparatus of claim 56, the apparatus further configured to reset the number to zero if the elapsed time since the last number reset is greater than a predetermined time interval.
58. The apparatus of claim 56, wherein the predetermined connection rate limit is a number of transactions per predetermined time interval.
59. The apparatus of claim 56, the apparatus further configured to detect a new server load balancing service connection request by looking at a SYN bit of an incoming transmission control protocol (TCP) packet.
60. The apparatus of claim 56 wherein the incrementing is based at least in part on the identification of the destination server load balancing service.
61. The apparatus of claim 56, the apparatus further configured to detect a new server load balancing service connection request by looking for any user datagram protocol (UDP) packets.
62. The apparatus of claim 56 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers having a least number of connections.
63. The apparatus of claim 56 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a round robin approach.
64. The apparatus of claim 56 wherein the predetermined scheme comprises directing the new server load balancing service connection request to a particular one of the plurality of servers according to a weighted approach.

The present application is related to co-pending application Ser. No. 10/139,073, filed May 3, 2002, by Ronald W. Szeto, David Chun Ying Cheung, and Rajkumar Jalan, entitled “CONNECTION RATE LIMITING”.

A portion of the disclosure of this patent document contains material which is subject to copyright protection. The copyright owner has no objection to the facsimile reproduction by anyone of the patent document or the patent disclosure, as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.

The present invention relates to the field of web switches. More particularly, the present invention relates to connection rate limiting to ensure proper functioning of components on a web switch.

Web switches provide traffic management to computer networks. The traffic management extends to packets received both from an outside network, such as the Internet, and from an internal network. A web switch may provide a series of software components to better handle the traffic. These components may include server load balancing (SLB), transparent cache switching (TCS), and firewall load balancing (FWLB). Server load balancing allows IP-based services to be transparently balanced across multiple servers. This distributed design prevents servers from getting overloaded. Transparent cache switching allows for distributed cache servers, and likewise prevents the cache servers from getting overloaded. Firewall load balancing increases the network's overall firewall performance by distributing the Internet traffic load across multiple firewalls.

Even though these software components are designed to manage traffic, the components themselves may become overwhelmed when traffic is heavy. For example, a server running TCS may become so overloaded with connections that it fails to properly handle packets sent through the connections. Traditional techniques for handling such a situation involve limiting the packet rate. This involves monitoring the number of packets received in short intervals, and dropping or redirecting packets if the number exceeds a threshold value. Unfortunately, for traffic management components, the number of packets received is not a direct predictor of when the components will become overloaded. These traffic management components are more likely to become overloaded when new connections are being established too quickly, as opposed to when new packets are coming in over those connections.

What is needed is a solution to better handle increased traffic to traffic management components.

Each service in a computer network may have a connection rate limit. The number of new connections per time period may be limited by using a series of rules. In a specific embodiment of the present invention, a counter is increased each time a server is selected to handle a connection request. For each service, connections coming in are tracked. Therefore, the source of connection-request packets need not be examined. Only the destination service is important. This saves significant time in the examination of the incoming requests. Each service may have its own set of rules to best handle the new traffic for its particular situation. For server load balancing, a reset may be sent to the source address of the new connection request. For transparent cache switching, the connection request may be forwarded to the Internet.

The accompanying drawings, which are incorporated into and constitute a part of this specification, illustrate one or more embodiments of the present invention and, together with the detailed description, serve to explain the principles and implementations of the invention.

In the drawings:

FIG. 1 is a flow diagram illustrating a method for managing a traffic management service in a computer network in accordance with a specific embodiment of the present invention.

FIG. 2 is a flow diagram illustrating a method for managing a traffic management service distributed over multiple servers in a computer network in accordance with a specific embodiment of the present invention.

FIG. 3 is a flow diagram illustrating a method for managing a firewall load balancing service in a computer network in accordance with a specific embodiment of the present invention.

FIG. 4 is a flow diagram illustrating a method for managing a firewall load balancing service distributed over multiple firewalls in a computer network in accordance with a specific embodiment of the present invention.

FIG. 5 is a flow diagram illustrating a method for managing a server load balancing service in a computer network in accordance with a specific embodiment of the present invention.

FIG. 6 is a flow diagram illustrating a method for managing a server load balancing service distributed over multiple servers in a computer network in accordance with a specific embodiment of the present invention.

FIG. 7 is a flow diagram illustrating a method for managing a transparent cache switching service in a computer network in accordance with a specific embodiment of the present invention.

FIG. 8 is a flow diagram illustrating a method for managing a transparent cache switching service distributed over multiple caches in a computer network in accordance with a specific embodiment of the present invention.

FIG. 9 is a block diagram illustrating an apparatus for managing a traffic management service in a computer network in accordance with a specific embodiment of the present invention.

FIG. 10 is a block diagram illustrating an apparatus for managing a firewall load balancing service in a computer network in accordance with a specific embodiment of the present invention.

FIG. 11 is a block diagram illustrating an apparatus for managing a firewall load balancing service distributed over multiple firewalls in a computer network in accordance with a specific embodiment of the present invention.

FIG. 12 is a block diagram illustrating an apparatus for managing a server load balancing service in a computer network in accordance with a specific embodiment of the present invention.

FIG. 13 is a block diagram illustrating an apparatus for managing a transparent cache switching service in a computer network in accordance with a specific embodiment of the present invention.

Embodiments of the present invention are described herein in the context of a system of computers, servers, and software. Those of ordinary skill in the art will realize that the following detailed description of the present invention is illustrative only and is not intended to be in any way limiting. Other embodiments of the present invention will readily suggest themselves to such skilled persons having the benefit of this disclosure. Reference will now be made in detail to implementations of the present invention as illustrated in the accompanying drawings. The same reference indicators will be used throughout the drawings and the following detailed description to refer to the same or like parts.

In the interest of clarity, not all of the routine features of the implementations described herein are shown and described. It will, of course, be appreciated that in the development of any such actual implementation, numerous implementation-specific decisions must be made in order to achieve the developer's specific goals, such as compliance with application- and business-related constraints, and that these specific goals will vary from one implementation to another and from one developer to another. Moreover, it will be appreciated that such a development effort might be complex and time-consuming, but would nevertheless be a routine undertaking of engineering for those of ordinary skill in the art having the benefit of this disclosure.

In accordance with the present invention, the components, process steps, and/or data structures may be implemented using various types of operating systems, computing platforms, computer programs, and/or general purpose machines. In addition, those of ordinary skill in the art will recognize that devices of a less general purpose nature, such as hardwired devices, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), or the like, may also be used without departing from the scope and spirit of the inventive concepts disclosed herein.

A traffic management component may be distributed over many different servers. Therefore, for purposes of this application a specific component type (such as TCS) may be referred to as a service. In accordance with a specific embodiment of the present invention, each service has a connection rate limit. The number of new connections per time period may be limited by using a series of rules. In a specific embodiment of the present invention, a counter is increased each time a server is selected to handle a connection request. For each service, connections coming in are tracked. Therefore, the source of connection-request packets need not be examined. Only the destination service is important. This saves significant time in the examination of the incoming requests. Each service may have its own set of rules to best handle the new traffic for its particular situation.

In accordance with a specific embodiment of the present invention, a new transmission control protocol (TCP) connection request may be detected by looking at the SYN bit of the incoming packet. If it is set to on, then the packet is a new connection request. In accordance with another specific embodiment of the present invention, a new user datagram protocol (UDP) connection request may be detected by looking for any packet that doesn't have a session.

In accordance with a specific embodiment of the present invention, connection rate limiting is applied to a server load balancing service. Upon receipt of a connection request that would exceed the maximum number of permitted connections per second, a reset is sent to the client (requesting party). Thus, instead of a user's request simply appearing to “hang” indefinitely, feedback is provided to the user to try again.

In accordance with a specific embodiment of the present invention, connection rate limiting is applied to transparent cache switching. Upon receipt of a connection request that would exceed the maximum number of permitted connections per second, the request is sent to the Internet. Thus, instead of not getting the service at all, the user still has a strong change of getting the request served. This process is transparent to the user.

In accordance with a specific embodiment of the present invention, connection rate limiting is applied to firewall load balancing. Upon receipt of a connection request that would exceed the maximum number of permitted connections per second, the request is hashed to send it to a specific firewall. A hashing scheme may be applied to determine to which firewall to send the connection request. Different criteria may be applied in the hash table. For example, the hash table may be defined to direct the request to the firewall with the least connections. Alternatively, a round robin approach may be applied. In another embodiment, a weighted approach may be applied. The “scheme” may alternatively be a lack of a scheme, i.e., packets are simply dropped if the number of permitted connections per second is exceeded.

In accordance with another embodiment of the present invention, the connection rate limiting may be applied on a per server basis in addition to or instead of a per service basis. For example, the number of connections sent to a particular firewall may be limited, but other firewalls in the system may have no limiting or a different limiting scheme applied.

FIG. 1 is a flow diagram illustrating a method for managing a traffic management service in a computer network in accordance with a specific embodiment of the present invention. At 100, a new connection request for the service is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new connection request for the service may be detected by looking for any user datagram protocol (UDP) packets without a session. At 102, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 104, a counter is incremented each time a new connection request is received for the service. At 106, new connection requests received for the service are denied if the counter increases at a rate exceeding a predetermined connection rate limit for the service. This denial may comprise sending a reset to a source address contained in a new connection request. Alternatively, it may comprise forwarding the new connection request to the Internet. It may also forward the new connection request in accordance with criteria in a hash table. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 2 is a flow diagram illustrating a method for managing a traffic management service distributed over multiple servers in a computer network in accordance with a specific embodiment of the present invention. At 200, a new connection request for the service is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new connection request for the service may be detected by looking for any user datagram protocol (UDP) packets without a session. At 202, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 204, a counter is incremented each time a new connection request is received for the service on one of the servers. At 206, new connection requests received for the service on the one server are denied if the counter increases at a rate exceeding a predetermined connection rate limit for the service on that server. This denying may comprise sending a reset to a source address contained in a new connection request. Alternatively, it may comprise forwarding the new connection request to the Internet. It may also forward the new connection request in accordance with criteria in a hash table. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 3 is a flow diagram illustrating a method for managing a firewall load balancing service in a computer network in accordance with a specific embodiment of the present invention. At 300, a new firewall load balancing service connection request is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new firewall load balancing service connection request may be detected by looking for any user datagram protocol (UDP) packets without a session. At 302, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 304, a counter is incremented each time a new firewall load balancing service connection request is received. At 306, new firewall load balancing service connection requests are dropped if the counter increases at a rate exceeding a predetermined firewall load balancing service connection rate limit. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 4 is a flow diagram illustrating a method for managing a firewall load balancing service distributed over multiple firewalls in a computer network in accordance with a specific embodiment of the present invention. At 400, a new firewall load balancing service connection request for the service is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new firewall load balancing service connection request for the service may be detected by looking for any user datagram protocol (UDP) packets without a session. At 402, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 404, a counter is incremented each time a new firewall load balancing service connection request is received. At 406, a hashing scheme is applied to determine to which firewall to forward a new firewall load balancing service connection request if the counter increases at a rate exceeding a predetermined firewall load balancing service connection rate limit. The hashing scheme may be one of several different possibilities. It may comprise directing a new firewall load balancing service connection request to the firewall with the least connections. It may comprise directing a new firewall load balancing service connection request to a firewall according to a round robin approach. It may comprise directing a new firewall load balancing service connection request to a firewall according to a weighted approach. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 5 is a flow diagram illustrating a method for managing a server load balancing service in a computer network in accordance with a specific embodiment of the present invention. At 500, a new server load balancing service connection request is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new server load balancing connection request may be detected by looking for any user datagram protocol (UDP) packets without a session. At 502, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 504, a counter is incremented each time a new server load balancing service connection request is received. At 506, a reset is sent to a source address contained in the new server load balancing service connection request if the counter increases at a rate exceeding a predetermined server load balancing service connection rate limit. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 6 is a flow diagram illustrating a method for managing a server load balancing service distributed over multiple servers in a computer network in accordance with a specific embodiment of the present invention. At 600, a new server load balancing service connection request for the server is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new server load balancing connection request for the server may be detected by looking for any user datagram protocol (UDP) packets without a session. At 602, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 604, a counter is incremented each time a new server load balancing service connection request for the server is received. At 606, a reset is sent to a source address contained in the new server load balancing service connection request if the counter increases at a rate exceeding a predetermined server load balancing service connection rate limit for the server. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 7 is a flow diagram illustrating a method for managing a transparent cache switching service in a computer network in accordance with a specific embodiment of the present invention. At 700, a new transparent cache switching service connection request is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new transparent cache switching service connection request may be detected by looking for any user datagram protocol (UDP) packets without a session. At 702, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 704, a counter is incremented each time a new transparent cache switching service connection request is received. At 706, the new transparent cache switching service connection request is sent to the Internet if the counter increases at a rate exceeding a predetermined transparent cache switching service connection rate limit. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 8 is a flow diagram illustrating a method for managing a transparent cache switching service distributed over multiple caches in a computer network in accordance with a specific embodiment of the present invention. At 800, a new transparent cache switching service connection request for one of the caches is detected by looking at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a new transparent cache switching service connection request for one of the caches may be detected by looking for any user datagram protocol (UDP) packets without a session. At 802, a counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. At 804, a counter is incremented each time a new transparent cache switching service connection request for the cache is received. At 806, the new transparent cache switching service connection request is sent to the Internet if the counter increases at a rate exceeding a predetermined transparent cache switching service connection rate limit for the cache. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 9 is a block diagram illustrating an apparatus for managing a traffic management service in a computer network in accordance with a specific embodiment of the present invention. A memory 900 may be used to store a counter. A new connection request detector 902 may detect a new connection request for the service. A SYN bit examiner 904 may be used for this purpose to look at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a user datagram protocol packet session examiner 906 may detect a new connection request for the service by looking for any user datagram protocol (UDP) packets without a session. A counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. A new connection request counter incrementer 908 coupled to the memory 900 and to the new connection request detector 902 increments the counter each time a new connection request is received for the service. If the service is distributed over multiple servers and the request is for one of the servers, the new connection request counter incrementer 908 may increment a counter each time a new connection request is received for the service on the one server. A new connection request denier 910 coupled to the new connection request counter incrementer 908 and to the memory 900 denies new connection requests received for the service if the counter increases at a rate exceeding a predetermined connection rate limit for the service. If the service is distributed over multiple servers and the request is for one of the servers, the new connection request denier 910 may deny new connection requests received for the service on the server if the counter increases at a rate exceeding a predetermined connection rate limit for the service on the server. This denying may comprise sending a reset to a source address contained in a new connection request using a source address reset sender 912. Alternatively, it may comprise forwarding the new connection request to the Internet using a new connection request Internet forwarder 914. It may also forward the new connection request as per a hash table using a new connection request hash table forwarder 916. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 10 is a block diagram illustrating an apparatus for managing a firewall load balancing service in a computer network in accordance with a specific embodiment of the present invention. A memory 1000 may be used to store a counter. A new firewall load balancing service connection request detector 1002 may detect a new firewall load balancing service connection request. A SYN bit examiner 1004 may be used for this purpose to look at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a user datagram protocol packet session examiner 1006 may detect a new firewall load balancing connection request by looking for any user datagram protocol (UDP) packets without a session. A counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. A new firewall load balancing service connection request counter incrementer 1008 coupled to the memory 1000 and to the new firewall load balancing service connection request detector 1002 increments the counter each time a new firewall load balancing service connection request is received. A new firewall load balancing service connection request dropper 1010 coupled to the new firewall load balancing service connection request counter incrementer 1008 and to the memory 1000 drops new firewall load balancing service connection requests if the counter increases at a rate exceeding a predetermined firewall load balancing service connection rate limit. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 11 is a block diagram illustrating an apparatus for managing a firewall load balancing service distributed over multiple firewalls in a computer network in accordance with a specific embodiment of the present invention. A memory 1100 may be used to store a counter. A new firewall load balancing service connection request detector 1102 may detect a new firewall load balancing service connection request. A SYN bit examiner 1104 may be used for this purpose to look at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a user datagram protocol packet session examiner 1106 may detect a new firewall load balancing service connection request by looking for any user datagram protocol (UDP) packets without a session. A counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. A new firewall load balancing service connection request counter incrementer 1108 coupled to the memory 1100 and to the new firewall load balancing service connection request detector 1102 increments the counter each time a new firewall load balancing service connection request is received. A new firewall load balancing service connection request hashing scheme applier 1110 coupled to the new firewall load balancing service connection request counter incrementer 1108 and to the memory 1100 applies a hashing scheme to determine to which firewall to forward a new firewall load balancing service connection request if the counter increases at a rate exceeding a predetermined firewall load balancing service connection rate limit. The hashing scheme may be one of several different possibilities. It may comprise directing a new firewall load balancing service connection request to the firewall with the least connections. It may comprise directing a new firewall load balancing service connection request to a firewall according to a round robin approach. It may comprise directing a new firewall load balancing service connection request to a firewall according to a weighted approach. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 12 is a block diagram illustrating an apparatus for managing a server load balancing service in a computer network in accordance with a specific embodiment of the present invention. A memory 1200 may be used to store a counter. A new server load balancing service connection request detector 1202 may detect a new server load balancing service connection request. A SYN bit examiner 1204 may be used for this purpose to look at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a user datagram protocol packet session examiner 1206 may detect a new server load balancing service connection request for the service by looking for any user datagram protocol (UDP) packets without a session. A counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. A new server load balancing service connection request counter incrementer 1208 coupled to the memory 1200 and to the new server load balancing service connection request detector 1202 increments a counter each time a new server load balancing connection request is received. If the service is distributed over multiple servers and the request is for one of the servers, the new server load balancing service connection request counter incrementer 1208 may increment the counter each time a new server load balancing service connection request is received for the server. A new server load balancing service connection request source address reset sender 1210 coupled to the new server load balancing service connection request counter incrementer 1208 and to the memory 1200 sends a reset to the source address of the new server load balancing service connection request if the counter increases at a rate exceeding a predetermined server load balancing service connection rate limit. If the service is distributed over multiple servers and the request is for one of the servers, the new server load balancing service connection request source address reset sender 1210 may send a reset to the source address of the new server load balancing service connection request if the counter increases at a rate exceeding a predetermined connection rate limit for the service on the server. The connection rate limit may be a number of connections per predetermined time interval.

FIG. 13 is a block diagram illustrating an apparatus for managing a transparent cache switching service in a computer network in accordance with a specific embodiment of the present invention. A memory 1300 may be used to store a counter. A new transparent cache switching service connection request detector 1302 may detect a new transparent cache switching service connection request. A SYN bit examiner 1304 may be used for this purpose to look at a SYN bit of an incoming transmission control protocol (TCP) packet. Alternatively, a user datagram protocol packet session examiner 1306 may detect a new transparent cache switching service connection request for the service by looking for any user datagram protocol (UDP) packets without a session. A counter is reset to zero if the elapsed time since the last counter reset is greater than a predetermined time interval. A new transparent cache switching service connection request counter incrementer 1308 coupled to the memory 1300 and to the new transparent cache switching service connection request detector 1302 increments the counter each time a new transparent cache switching connection request is received. If the service is distributed over multiple caches and the request is for one of the caches, the new transparent cache switching service connection request counter incrementer 1308 may increment a counter each time a new transparent cache switching service connection request is received for the cache. A new transparent cache switching service connection request Internet sender 1310 coupled to the new transparent cache switching service connection request counter incrementer 1308 and to the memory 1300 sends the new transparent cache switching service connection request to the Internet if the counter increases at a rate exceeding a predetermined transparent cache switching service connection rate limit. If the service is distributed over multiple caches and the request is for one of the caches, the new transparent cache switching service connection request Internet sender 1310 may send the new transparent cache switching service connection request to the Internet if the counter increases at a rate exceeding a predetermined transparent cache switching service connection rate limit for the cache. The connection rate limit may be a number of connections per predetermined time interval.

While embodiments and applications of this invention have been shown and described, it would be apparent to those skilled in the art having the benefit of this disclosure that many more modifications than mentioned above are possible without departing from the inventive concepts herein. The invention, therefore, is not to be restricted except in the spirit of the appended claims.

Jalan, Rajkumar, Cheung, David Chun Ying, Szeto, Ronald W.

Patent Priority Assignee Title
Patent Priority Assignee Title
4926480, Aug 22 1983 VAN DETSAN NETWORKS LIMITED LIABILITY COMPANY Card-computer moderated systems
5761507, Mar 05 1996 GLOBALFOUNDRIES Inc Client/server architecture supporting concurrent servers within a server with a transaction manager providing server/connection decoupling
5774660, Aug 05 1996 RESONATE INC World-wide-web server with delayed resource-binding for resource-based load balancing on a distributed resource multi-node network
5956489, Jun 07 1995 Microsoft Technology Licensing, LLC Transaction replication system and method for supporting replicated transaction-based services
6044260, Sep 02 1997 Google Technology Holdings LLC Method of controlling the number of messages received by a personal messaging unit
6075772, Aug 29 1997 International Business Machines Corporation Methods, systems and computer program products for controlling data flow for guaranteed bandwidth connections on a per connection basis
6088452, Mar 07 1996 Nortel Networks Limited Encoding technique for software and hardware
6195680, Jul 23 1998 Level 3 Communications, LLC Client-based dynamic switching of streaming servers for fault-tolerance and load balancing
6314465, Mar 11 1999 WSOU Investments, LLC Method and apparatus for load sharing on a wide area network
6336133, May 20 1997 Meta Platforms, Inc Regulating users of online forums
6338133, Mar 12 1999 International Business Machines Corporation Measured, allocation of speculative branch instructions to processor execution units
6381642, Oct 21 1999 Brocade Communications Systems, Inc In-band method and apparatus for reporting operational statistics relative to the ports of a fibre channel switch
6389448, Dec 06 1999 WARP Solutions, Inc.; WARP SOLUTIONS, INC System and method for load balancing
6438652, Oct 09 1998 International Business Machines Corporation Load balancing cooperating cache servers by shifting forwarded request
6457061, Nov 24 1998 PMC-SIERRA US, INC Method and apparatus for performing internet network address translation
6526448, Dec 22 1998 AT&T Corp Pseudo proxy server providing instant overflow capacity to computer networks
6587881, Apr 09 1999 Microsoft Technology Licensing, LLC Software server usage governor
6597661, Aug 25 1999 GOLDMAN SACHS SPECIALTY LENDING GROUP L P Network packet classification
6701415, Mar 31 1999 Citrix Systems, Inc Selecting a cache for a request for information
6763372, Jul 06 2000 Microsoft Technology Licensing, LLC Load balancing of chat servers based on gradients
6851062, Sep 27 2001 International Business Machines Corporation System and method for managing denial of service attacks
6857025, Apr 05 2000 International Business Machines Corporation Highly scalable system and method of regulating internet traffic to server farm to support (min,max) bandwidth usage-based service level agreements
6883033, Feb 20 2001 International Business Machines Corporation System and method for regulating incoming traffic to a server farm
7007092, Oct 05 2000 Juniper Networks, Inc Connection management system and method
7107609, Jul 20 2001 Hewlett Packard Enterprise Development LP Stateful packet forwarding in a firewall cluster
7131140, Dec 29 2000 Cisco Technology, Inc. Method for protecting a firewall load balancer from a denial of service attack
20010039585,
20010042200,
20010047415,
20020040400,
20020099831,
20030041146,
20040024861,
20040162901,
/
Executed onAssignorAssigneeConveyanceFrameReelDoc
May 03 2002Foundry Networks, Inc.(assignment on the face of the patent)
Date Maintenance Fee Events


Date Maintenance Schedule
Aug 10 20134 years fee payment window open
Feb 10 20146 months grace period start (w surcharge)
Aug 10 2014patent expiry (for year 4)
Aug 10 20162 years to revive unintentionally abandoned end. (for year 4)
Aug 10 20178 years fee payment window open
Feb 10 20186 months grace period start (w surcharge)
Aug 10 2018patent expiry (for year 8)
Aug 10 20202 years to revive unintentionally abandoned end. (for year 8)
Aug 10 202112 years fee payment window open
Feb 10 20226 months grace period start (w surcharge)
Aug 10 2022patent expiry (for year 12)
Aug 10 20242 years to revive unintentionally abandoned end. (for year 12)