A method and apparatus for accelerating network server performance optimization

Abstract

The application provides a method and device for accelerating network server performance optimization, the method comprising: writing a target device address into a TCP extension SACK in a first request data packet sent by a client; the server intercepts the first request data packet, obtains the target device address and the client device address therefrom, modifies the TCP extension SACK into the client device address, forms a second request data packet, and then sends the second request data packet to the target device after being relayed; after the target device receives the second request data packet, the client device address is obtained, the target device processes data, generates a first feedback data packet, and writes the client device address into a TCP extension SACK in the first feedback data packet; the server intercepts the first feedback data packet, deletes the address in the TCP extension SACK therefrom, forms a second feedback data packet, and then sends the second feedback data packet to the client, thereby reducing operation and maintenance costs.

Description

Technical Field

[0001] This invention relates to the field of technology, and in particular to a method and apparatus for accelerating the performance optimization of network servers. Background Technology

[0002] With the surge in cross-border e-commerce enterprises and cloud office equipment, the scale of cross-border network acceleration services is also growing, leading to increasingly higher demands for performance, stability, and operational efficiency.

[0003] Existing cross-border network acceleration services generally consist of the following four parts:

[0004] Client: Typically runs on the user's office equipment, acting as a local proxy responsible for forwarding network requests from the user's equipment and receiving request results.

[0005] Pick-up point: This is usually a Linux server, the entry point for user traffic, responsible for forwarding traffic between user devices and drop-off points.

[0006] Drop-off point: Typically a Linux server, this is the exit point for user cross-border traffic, responsible for forwarding traffic between the loading point and the destination device according to the rules configured at the loading point. The drop-off point and loading point are connected via VXLAN (Virtual Extensible LAN), a technology provided by a third-party operator. In this system, the drop-off point can be considered equivalent to the loading point.

[0007] Target device: User traffic exit point, responsible for user authentication and the final exit point of user traffic, with a fixed exit IP address for user traffic, meeting strict enterprise security verification requirements.

[0008] The existing solution is based on Linux Netfilter network layer data forwarding. Its biggest advantage is that no development is required. With just a few simple configurations using the Linux command-line tool iptables, traffic forwarding between the client and the target device can be achieved.

[0009] The boarding point needs to be configured with forwarding rules to bind the target device's IP address and port to the boarding point's IP address and port. First, configure a DNAT (Destination IP Address Translation) rule for a fixed port to forward data actively requested by the user device to the target device. Then, configure MASQUERADE (Dynamic Source IP Address Translation) to send the target device's response data back to the source user device.

[0010] The specific data processing procedure is as follows:

[0011] 1. Arrival of request data packet: The request data packet from the user device arrives at the designated port of the boarding point. The data packet contains the source IP address of the user device.

[0012] 2. Matching rules: The kernel checks the DNAT rules and executes subsequent steps;

[0013] 3. Modify the target IP address and port: The kernel replaces the target IP address and port of the request packet with the target device IP address and port according to the DNAT rules;

[0014] 4. Modify source IP address: The kernel replaces the source IP of the requested data with the exit IP address of the boarding point;

[0015] 5. Modify connection tracking information: The kernel automatically updates conntrack (connection tracking table) according to MASQUERADE rules, records the modified source IP of user devices and maintains the connection status, which is crucial for subsequent response packets to be sent back to user devices;

[0016] 6. Forwarding the request data packet: The modified request data packet is forwarded to the target device;

[0017] 7. Response packet processing: When the target device's response packet arrives, check conntrack again to obtain the user device's source IP address, and the kernel replaces the target IP of the packet with the user device's IP.

[0018] 8. Forwarding response data packets: The modified response data packets are forwarded to the user equipment.

[0019] The above solution is not suitable for large-scale application. The specific problems are as follows:

[0020] Problem 1: A single boarding point can easily reach a performance bottleneck.

[0021] When the boarding point processes the response data packet (step 7 above), for each response data packet, it is necessary to check conntrack to obtain the source IP of the user device for that data packet.

[0022] Checking conntrack is a complex and time-consuming process. The more user devices that connect, the more records are in conntrack, and the longer it takes to find the source IP of a user device on average. In actual testing, when the number of user device connections at a single boarding point reaches 2000 and is used simultaneously, the boarding point consumes a large amount of CPU resources to check conntrack, and the efficiency of processing response packets drops significantly, limiting the maximum load of a single boarding point.

[0023] Question 2: A single boarding point can easily reach a bottleneck in port resources.

[0024] To significantly simplify iptables rules, it is necessary to allocate a separate port for each enterprise, and a port can only serve one enterprise at a time.

[0025] Due to operating system limitations, a device has fewer than 20,000 available listening ports, which also limits the maximum load of a single boarding point.

[0026] Question 3: Complex configuration and low operational efficiency.

[0027] The service backend needs to maintain the mapping between the access point, port, and target device, and write this mapping into the corresponding access point's iptables rules. When an enterprise user connects, an access point and port need to be assigned. When an enterprise user leaves, the assigned access point and port need to be reclaimed promptly.

[0028] Because individual access points have limited load capacity, only one access point and port are allocated to the same target device to improve utilization. When a single access point fails, the iptables rules on the failed node need to be transferred in batches to a new access point, and the corresponding users need to be notified to reconnect. Furthermore, global network conditions are highly variable, and local network nodes often become unavailable due to natural disasters, construction, or hardware failures. This complex configuration leads to low efficiency in operations and maintenance for handling and recovering from unexpected faults. Summary of the Invention

[0029] The technical problem to be solved by the present invention is to provide a method and apparatus for accelerating network server performance optimization, thereby solving the performance bottleneck and port resource bottleneck of the loading point.

[0030] In a first aspect, the present invention provides a method for accelerating network server performance optimization, comprising the following steps:

[0031] Step 1: Write the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes the source IP address and the destination IP address. The source IP address is the client device address, and the destination IP address is the server address.

[0032] Step 2: The server intercepts the first request data packet and obtains the target device address and the client device address from it; it modifies the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extension SACK to the client device address, forming a second request data packet, which is then sent to the target device after being relayed.

[0033] Step 3: After the target device receives the second request data packet, the target device processes the data, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extension SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address.

[0034] Step 4: The server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extension SACK to form the second feedback data packet. Then, the second feedback data packet is sent to the client.

[0035] Secondly, the present invention provides an apparatus for accelerating network server performance optimization, comprising:

[0036] The data sending module writes the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address.

[0037] The intercept and forward request data module intercepts the first request data packet and obtains the target device address and client device address from it. The source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extension SACK is modified to the client device address to form a second request data packet. After being forwarded, it is sent to the target device.

[0038] The feedback data module processes data after the target device receives the second request data packet, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extension SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address.

[0039] The intercept and forward feedback data module intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extension SACK, forming the second feedback data packet, which is then sent to the client.

[0040] One or more technical solutions provided by this invention have at least the following technical effects or advantages:

[0041] This invention eliminates reliance on the operating system protocol stack, resolving performance and port resource bottlenecks at the boarding point. By extending standard TCP options and removing iptables rule configurations, the boarding point service becomes stateless, significantly reducing overall system complexity and operational costs.

[0042] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0043] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0044] Figure 1 This is a flowchart of the method in Embodiment 1 of the present invention;

[0045] Figure 2 This is a schematic diagram of the device in Embodiment 2 of the present invention. Detailed Implementation

[0046] This application provides a method and apparatus for accelerating network server performance optimization, which no longer relies on the operating system protocol stack and solves the performance bottleneck and port resource bottleneck at the loading point.

[0047] The overall concept of the technical solution in this application embodiment is as follows:

[0048] By extending the capabilities of standard TCP protocol items, DNAT is supported at the protocol level, thereby removing iptables rules and eliminating reliance on the operating system's network protocol stack. This invention utilizes the TCP protocol idle standard item TCP extension SACK for sending DNAT extended rules.

[0049] The client supports TCP implementation of DNAT extension rules through PCAP (Package Capture, a network packet development library).

[0050] The boarding point supports TCP DNAT extension rules through eBPF (Extended Berkeley Packer Filter, a Linux kernel virtual machine).

[0051] The target device provides application proxy services through Xary-core (application proxy development library), which supports TCP implementation of DNAT extended rules.

[0052] Example 1

[0053] like Figure 1 As shown, this embodiment provides a method for accelerating network server performance optimization, including the following steps:

[0054] Step 1: Write the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes the source IP address and the destination IP address. The source IP address is the client device address, and the destination IP address is the server address.

[0055] Step 2: The server intercepts the first request data packet and obtains the target device address and the client device address from it. The client device address in the first request data packet is cached. The source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extension SACK is modified to the client device address to form the second request data packet. After being forwarded, it is sent to the target device.

[0056] Step 3: After the target device receives the second request data packet, it processes the data, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extension SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address. The target device uses Xray-core technology to read the client device address from the second request data packet and then writes the client device address into the TCP extension SACK in the first feedback data packet.

[0057] Step 4: The server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extension SACK to form the second feedback data packet. Then, the second feedback data packet is sent to the client.

[0058] In this embodiment, preferably, step 1 specifically involves: using a data capture and analysis tool to write the target device address into the TCP extension SACK in the first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, the source IP address being the client device address and the destination IP address being the server address; the data capture and analysis tool being PCAP.

[0059] In this embodiment, preferably, step 2 specifically involves: the server intercepting the first request data packet using eBPF technology and obtaining the target device address and client device address from it, caching the client device address in the first request data packet; modifying the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extension SACK to the client device address to form a second request data packet, which is then sent to the target device after being relayed.

[0060] In this embodiment, preferably, step 4 specifically involves: the server intercepting the first feedback data packet using eBPF technology, modifying the source IP address in the first feedback data packet to the server address, modifying the destination IP address to the client device address, and deleting the address in the TCP extension SACK to form a second feedback data packet, and then sending the second feedback data packet to the client.

[0061] Based on the same inventive concept, this application also provides an apparatus corresponding to the method in Embodiment 1, as detailed in Embodiment 2.

[0062] Example 2

[0063] like Figure 2 As shown, this embodiment provides an apparatus for accelerating network server performance optimization, comprising:

[0064] The data sending module writes the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address.

[0065] The intercept and forward request data module intercepts the first request data packet and obtains the target device address and client device address from it. The client device address in the first request data packet is cached. The source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extension SACK is modified to the client device address to form the second request data packet. After being forwarded, it is sent to the target device.

[0066] The feedback data module processes data after the target device receives the second request data packet, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extension SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address. The target device uses Xray-core technology to read the client device address from the second request data packet and then writes the client device address into the TCP extension SACK in the first feedback data packet.

[0067] The intercept and forward feedback data module intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extension SACK, forming the second feedback data packet, which is then sent to the client.

[0068] In this embodiment, preferably, the data sending module specifically involves: using a data capture and analysis tool to write the target device address into the TCP extension SACK in the first request data packet sent by the client, wherein the first request data packet includes a source IP address and a destination IP address, the source IP address being the client device address and the destination IP address being the server address; and the data capture and analysis tool being PCAP.

[0069] In this embodiment, preferably, the interception and forwarding request data module specifically performs the following steps: The server intercepts the first request data packet using eBPF technology and obtains the target device address and the client device address from it. The client device address in the first request data packet is cached. The source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extension SACK is modified to the client device address to form a second request data packet. After being relayed, the second request data packet is sent to the target device.

[0070] In this embodiment, preferably, the interception and forwarding feedback data module specifically involves: the server intercepting the first feedback data packet using eBPF technology, modifying the source IP address in the first feedback data packet to the server address, modifying the destination IP address to the client device address, and deleting the address in the TCP extension SACK to form a second feedback data packet, which is then sent to the client.

[0071] Since the apparatus described in Embodiment 2 of the present invention is an apparatus used to implement the method of Embodiment 1 of the present invention, those skilled in the art can understand the specific structure and variations of the apparatus based on the method described in Embodiment 1 of the present invention, and therefore will not be described again here. All apparatuses used in the method of Embodiment 1 of the present invention fall within the scope of protection of the present invention.

[0072] The advantages of the above embodiments are: they no longer rely on the operating system protocol stack, thus resolving the performance and port resource bottlenecks of the boarding point. By extending the functionality of standard TCP options and removing iptables rule configurations, the boarding point service becomes stateless, significantly reducing the complexity of the entire system and lowering operational costs.

[0073]

[0074]

[0075] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the present invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for accelerating network server performance optimization, characterized in that: Includes the following steps: Step 1: Write the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes the source IP address and the destination IP address. The source IP address is the client device address, and the destination IP address is the server address. Step 2: The server intercepts the first request data packet and obtains the target device address and the client device address from it; it modifies the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extension SACK to the client device address, forming a second request data packet, which is then sent to the target device after being relayed. Step 3: After the target device receives the second request data packet, the target device performs data processing, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extension SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address. Step 4: The server intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extension SACK to form the second feedback data packet. Then, the second feedback data packet is sent to the client.

2. The method for accelerating network server performance optimization according to claim 1, characterized in that: Step 1 specifically involves: using a data capture and analysis tool to write the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes a source IP address and a destination IP address, where the source IP address is the client device address and the destination IP address is the server address. The data capture and analysis tool is PCAP.

3. The method for accelerating network server performance optimization according to claim 1, characterized in that: Step 2 specifically involves the server intercepting the first request data packet using eBPF technology and obtaining the target device address and client device address from it; modifying the source IP address in the first request data packet to the server address, the destination IP address to the target device address, and the TCP extension SACK to the client device address to form a second request data packet, which is then forwarded to the target device.

4. The method for accelerating network server performance optimization according to claim 1, characterized in that: Step 4 specifically involves the server intercepting the first feedback data packet using eBPF technology, modifying the source IP address in the first feedback data packet to the server address, modifying the destination IP address to the client device address, and deleting the address in the TCP extension SACK to form the second feedback data packet. The second feedback data packet is then sent to the client.

5. An apparatus for accelerating network server performance optimization, characterized in that: include: The data sending module writes the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes a source IP address and a destination IP address, wherein the source IP address is the client device address and the destination IP address is the server address. The intercept and forward request data module intercepts the first request data packet and obtains the target device address and client device address from it. The source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extension SACK is modified to the client device address to form a second request data packet. After being forwarded, it is sent to the target device. The feedback data module processes data after the target device receives the second request data packet, generates a first feedback data packet, reads the client device address from the second request data packet, and writes the client device address into the TCP extension SACK in the first feedback data packet. The source IP address in the first feedback data packet is the target device address, and the destination IP address is the server address. The intercept and forward feedback data module intercepts the first feedback data packet, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extension SACK, forming the second feedback data packet, which is then sent to the client.

6. The apparatus for accelerating network server performance optimization according to claim 5, characterized in that: The data transmission module specifically involves using a data capture and analysis tool to write the target device address into the TCP extension SACK in the first request data packet sent by the client. The first request data packet includes a source IP address and a destination IP address, where the source IP address is the client device address and the destination IP address is the server address. The data capture and analysis tool is PCAP.

7. The apparatus for accelerating network server performance optimization according to claim 5, characterized in that: The intercept and forward request data module specifically works as follows: The server intercepts the first request data packet using eBPF technology and obtains the target device address and the client device address from it; the source IP address in the first request data packet is modified to the server address, the destination IP address is modified to the target device address, and the TCP extension SACK is modified to the client device address to form a second request data packet, which is then forwarded to the target device.

8. The apparatus for accelerating network server performance optimization according to claim 5, characterized in that: The interception and forwarding feedback data module specifically works as follows: The server intercepts the first feedback data packet using eBPF technology, modifies the source IP address in the first feedback data packet to the server address, modifies the destination IP address to the client device address, and deletes the address in the TCP extension SACK to form a second feedback data packet, which is then sent to the client.

Images