June 2015 Summaries

Marek Majkowski explores techniques for optimizing UDP application latency on Linux systems, focusing on modern features of multiqueue network interface cards (NICs). The experiment involves two Linux hosts using a UDP echo protocol to measure round-trip time (RTT), with optimizations including the SO_BUSY_POLL socket option, userspace busy polling, and CPU pinning to specific cores to reduce latency. The use of Receive Side Scaling (RSS), flow steering, Transmit Flow Steering (XFS), and Receive Flow Steering (RFS) are discussed to enhance packet handling across CPUs. Advanced methods such as disabling interrupt coalescing and leveraging hardware support like Accelerated RFS on Solarflare NICs, as well as low-level tweaks to NIC settings, further minimize latency. The document highlights the trade-offs between latency and throughput and concludes with recommendations for optimizing packet delivery in high-performance environments.

The text discusses the importance of protecting data as it travels between datacenters and how Cloudflare has built its own Public Key Infrastructure (PKI) to ensure secure communication between internal services. It explains that a strong PKI is crucial for securing distributed systems architectures, and provides detailed instructions on how to build an internal CA using CFSSL, an open source PKI toolkit developed by Cloudflare. The text also covers the process of issuing certificates and keys for applications, as well as how to establish trust across services with mutually authenticated TLS. Additionally, it mentions that Cloudflare's internal PKI can be used to issue certificates to third parties who are integrating with their network.

On June 24, 2015, Elenitsa Staykova introduced a free video course on using CloudFlare by Troy Hunt, available through Pluralsight for one week. The course covers setting up a site on CloudFlare and configuring name server records with DNS providers. It also delves into understanding SSL implementation, strengthening security profile of websites, and managing the firewall application to protect websites. This free resource aims to help users maximize their CloudFlare experience.

On June 22, 2015, Cloudflare announced its latest deployment in Osaka, Japan, marking their second data center in Japan and fifth in Asia. This expansion serves not only Osaka but also Nagoya and the entire Keihanshin metropolitan area, providing faster application delivery to over 30 million inhabitants. The new facility offers full redundancy of traffic with their Tokyo facility, bringing Cloudflare closer to all 110 million internet users in Japan. The text highlights the challenges faced by the Internet industry in Asia due to poor regional traffic management and lack of local interconnection among major telecommunications providers. It compares this situation to Europe's past struggle with intra-European traffic, which was resolved through the establishment of European internet exchange points (IXPs). The article also discusses how Cloudflare is addressing these challenges by maintaining direct connectivity to all Tier 1 operators and major regional incumbents throughout Asia. The deployment in Osaka demonstrates a significant improvement in latency for users in Nagoya, reducing it from 11ms to 7ms. This expansion further enhances Cloudflare's commitment to providing faster, safer, and better internet services globally.

In June 2015, major music labels obtained a broad court order to force internet infrastructure companies like CloudFlare to enforce trademarks and copyrights. The Electronic Frontier Foundation (EFF) challenged the order on behalf of CloudFlare, but it was denied by the court. This decision raised concerns about potential censorship of expressive websites with minimal court review. In response, CloudFlare filed a motion asking the federal court in Manhattan to modify the order and place responsibility for identifying infringing domain names back on the music labels. The case highlights the ongoing struggle between entertainment companies seeking to control internet content and internet infrastructure companies aiming to protect their users' rights and maintain neutrality.

godebug is a cross-platform debugger for the Go programming language created by the Mailgun team. It rewrites source code and injects function calls to enable breakpoints, variable declarations, and line tracing. The tool produces a single binary with no dependencies, allowing it to be used on various platforms without requiring additional tools or permissions. godebug is still young but functional, and its source rewriting technique has potential for standardization in the context of Go's build process.

The text discusses the process of achieving 1 million UDP packets per second on a Linux network stack. It begins by explaining the importance of measuring packets per second (pps) rather than bytes per second (Bps), as improving pps is more challenging. The author then describes the experimental setup, including two physical servers with multiple cores and a multi-queue 10G network card. The text goes on to detail various approaches for increasing the number of packets received per second, such as using sendmmsg and recvmmsg syscalls, pinning processes to specific CPUs, and configuring NICs to distribute packets across multiple RX queues. It also discusses the impact of NUMA performance and the use of SO_REUSEPORT flag for load distribution among receiver threads. The author concludes that achieving 1 million UDP packets per second is technically possible on a Linux machine, but it requires careful configuration and optimization to ensure even distribution of traffic across RX queues and receiver processes, as well as sufficient spare CPU capacity. The text also notes that the performance may vary depending on whether the application is processing received packets or not.

Apple's Worldwide Developers Conference (WWDC) highlighted new operating systems, iOS 9 and OS X El Capitan, which require application developers to use HTTPS and IPv6 network technologies. This makes CloudFlare an even more attractive option for developers looking to accelerate and secure their mobile applications and websites. With its automatic support for both IPv6 and HTTPS, as well as its Automatic IPv6 Gateway and Universal SSL services, CloudFlare helps developers meet Apple's requirements while also providing performance benefits and protection against malicious attacks.

CloudFlare, an Internet service provider, has been supporting IPv6 for four years and is celebrating its participation in World IPv6 Day. The company's Automatic IPv6 Gateway allows websites to support IPv6-only clients without requiring any changes to the website or hosting provider. Since 2011, CloudFlare has seen a steady increase in deployed IPv6 at end-user sites and is now the only global CDN that provides IPv4/IPv6 content delivery by default. The company's support for IPv6 includes logging systems, DDoS protection, and open source software for ECMP load balancing.