How we scaled nginx and saved the world 54 years every day

10 million websites, apps and APIs use Cloudflare to give their users a speed boost. At peak we serve more than 10 million requests a second across our 151 data centers. Over the years we’ve made many modifications to our version of NGINX to handle our growth. This is blog post is about one of them.

How NGINX works

NGINX is one of the programs that popularized using event loops to solve the C10K problem. Every time a network event comes in (a new connection, a request, or a notification that we can send more data, etc.) NGINX wakes up, handles the event, and then goes back to do whatever it needs to do (which may be handling other events). When an event arrives, data associated with the event is already ready, which allows NGINX to efficiently handle many requests simultaneously without waiting.

num_events = epoll_wait(epfd, /*returned=*/events, events_len, /*timeout=*/-1);
 Continue reading

Understanding the EIGRP command, “metric rib-scale”

 

You may recall that, when using Named-Mode EIGRP configuration you have automatic access to EIGRP Wide Metrics.  In addition to providing you a new K-Value (K6 which is used against Jitter and Energy) the EIGRP Distance formula has been revised (what they call, “scaled”) to account for links above-and-beyond 10Mbps.  Remember that with Classic-Mode EIGRP, the formula looked like this:

metric = ([K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay] * [K5 / (reliability + K4)]) * 256

In the formula, the “**bandwidth**” value was represented as:

BW = 10^7 / minimum BW

 

The problem with this “classic” method was that any link with a bandwidth higher than 10,000,000 bps (which only equates to 10Mbps, or 10^7 bps) was given the same BW value as an Ethernet segment.  In other words, whether you put Ethernet into that formula,  FastEthernet, Gigabit Ethernet, or anything even higher…they all equate to “1″. So in Classic Mode EIGRP, EIGRP couldn’t distinguish between these types of links to develop an accurate path to a destination.

When EIGRP Wide-Metrics were developed, Cisco “scaled” some portions of the formula to account for faster links (as Continue reading

Three-Day Workshop on Internet Governance Held in Quezon City, Philippines

This month was even more special for our Internet Governance campaign, with two significant (back-to-back) activities in the Philippines.

Earlier this month, the Philippines’ Department of ICT (DICT) signed a Memorandum of Understanding (MoU) with the Internet Society (ISOC) to facilitate the development of its National ICT Ecosystem Framework (NIEF) 2022. More details can be found here.

The following week, the Internet Society Asia-Pacific team conducted a face-to-face workshop on Internet Governance. The three-day workshop was organized as part of the Asia-Pacific Telecommunity 2018 work plan, and hosted by DICT.

Internet Society staff along with facilitators from the ISOC Philippines Chapter delivered this specially designed training workshop through presentations, Q&A sessions, individual and group activities, interactive quizzes, and a debate.

The majority of attendees were government officials from the Department of ICT, the National Privacy Commission, the National Telecommunications Commission, and the Upper and Lower Houses of Congress, but also included members of the technical community and civil society.

The sessions were highly interactive with participants actively asking questions and presenting their own ideas and arguments. The participant-led group discussions provided an opportunity for local issues to be openly discussed, and possible solutions to be considered.

For us, the workshop Continue reading

How to use the gpg command to encrypt Linux files

There are many reasons to encrypt files — even on a system that is well maintained and comparatively secure. The files may highly sensitive, contain personal information that you don't want to share with anyone, or be backed up to some variety of online storage where you'd prefer it be extra secure.Fortunately, commands for reliably encrypting files on Linux systems are easy to come by and quite versatile. One of the most popular is gpg.gpg vs pgp and OpenPGP Used both to encrypt files in place and prepare them to be sent securely over the Internet, gpg is related to, but not the same as, pgp and OpenPGP. While gpg is based on the OpenPGP standards established by the IETF, it is — unlike pgp — open source. Here's the rundown:To read this article in full, please click here

Connecting Postman to Firepower Management Center API

A few months back, I wrote an article about my Initial Observation on the Firepower FMC API. Today’s article takes this one step further with a step-to-step guide to connecting Postman to the FMC API. It is worth noting that this is not a directly useful process, but a process that should be expanded upon to achieve any objective that is better served by an API. Use cases might include bulk changes or integration with other security applications.

The Official REST API Guide can be found at the following URL.

Firepower REST API Quick Start Guide

It is also worth mentioning that the online API documentation can be found at https://<FMC-IP>/api-explorer on the FMC installation.

The general flow of the process we will be following is:

  • Connect to FMC using basic authentication
  • View the response to obtain the X-auth-access-token and DOMAIN-UUID
  • Leverage the X-auth-access-token and DOMAIN-UUID in a request for access control policies
  • Leverage the token, domain and policy ID to obtain a list of rules in that policy
  • Leverage the token, domain, policy ID and rule ID to obtain rule details

Throughout this process, we will not store any variables and the process will be completely manual for comprehensive understanding. Continue reading

IDG Contributor Network: The first step to starting an enterprise IoT project

At long last, the Internet of Things (IoT) is moving beyond the hype and initial deployment cycle and entering a phase where we are now seeing many successful enterprise implementations. Thousands of businesses across all industries have begun to experience the operational benefits and new value propositions delivered by the IoT. But, as I speak with customers, partners and industry leaders around the world, I still hear many frontline business and operations managers say that they are unsure how, exactly, to begin their IoT initiatives. Often, they have an idea for how they would like to use IoT in their business but are not aware of all the considerations they should think through before beginning, or how to create their project plan and measure the impact.To read this article in full, please click here

Google, Cisco amp-up enterprise cloud integration

The joint Google and Cisco Kubernetes platform for enterprise customers should appear before the end of the year, and things are getting warm between the two companies ahead of that highly anticipated release.Cisco and Google last October teamed up to develop a Kubernetes hybrid-cloud offering.  Kubernetes, originally designed by Google, is an open-source-based system for developing and orchestrating containerized applications.RELATED: How to make hybrid cloud work The Cisco/Google combination – which is currently being tested by early access enterprise customers, according to Google – will let IT managers and application developers use Cisco tools to manage their on-premises environments and link it up with Google’s public IaaS cloud which offers orchestration, security and ties to a vast developer community.To read this article in full, please click here

Google, Cisco amp-up enterprise cloud integration

The joint Google and Cisco Kubernetes platform for enterprise customers should appear before the end of the year, and things are getting warm between the two companies ahead of that highly anticipated release.Cisco and Google last October teamed up to develop a Kubernetes hybrid-cloud offering.  Kubernetes, originally designed by Google, is an open-source-based system for developing and orchestrating containerized applications.RELATED: How to make hybrid cloud workThe Cisco/Google combination – which is currently being tested by an early access enterprise customer, according to Google – will let IT managers and application developers use Cisco tools to manage their on-premises environments and link it up with Google’s public IaaS cloud which offers orchestration, security and ties to a vast developer community.To read this article in full, please click here

Minecraft API with Workers + Coffeescript

Minecraft API with Workers + Coffeescript

The following is a guest post by Ashcon Partovi, a computer science and business undergraduate at the University of British Columbia in Vancouver, Canada. He's the founder of a popular Minecraft multiplayer server, stratus.network, that provides competitive, team-based gameplay to thousands of players every week

Minecraft API with Workers + Coffeescript

If you've ever played a video game in the past couple of years, chances are you know about Minecraft. You might be familiar with the game or even planted a tree or two, but what you might not know about is the vast number of Minecraft online communities. In this post, I'm going to describe how I used Cloudflare Workers to deploy and scale a production-grade API that solves a big problem for these Minecraft websites.

Introducing the Problem

Here is an example of my Minecraft player profile from one of the many multiplayer websites. It shows some identity information such as my username, a bitmap of my avatar, and a preview of my friends. Although rendering this page with 49 bitmap avatars may seem like an easy task, it's far from trivial. In fact, it's unnecessarily complicated.

Minecraft API with Workers + Coffeescript

Here is the current workflow to render a player profile on a website given Continue reading

Research; HTTPS Interceptions

I have written elsewhere about the problems with the “little green lock” shown by browsers to indicate a web page (or site) is secure. In that article, I considered the problem of freely available certificates, and a hole in the way browsers load pages. In March of 2017, another paper was published documenting another problem with the “green lock” paradigm—the impact of HTTPS interception. In theory, a successful HTTPS session means the session between host and the server has been encrypted, which means no third party can read the contents of the packets passing between the two.

This works, modulo the trustworthiness of the certificates involved in encrypting the traffic, so long as there is no-one in the middle of the connection encrypting packets from the receiver, and re-encrypting them towards the transmitter. This “man in the middle,” or MITM, can read the contents of all the packets in the exchange, even though the data is encrypted on transmit. Surely such MITM situations are rare, right?

Right.

The researchers in this paper set out to discover just how often HTTPS (LTS) sessions are terminated and re-encrypted by some device or piece of software in the middle. To discover how often Continue reading

1 … 1,591 1,592 1,593 1,594 1,595 … 3,916