Re: squid with random outgoing ip from pool of 1000 ips

[--Ahmad-- <ahmed.zaeem@xxxxxxxxxxxx>]

just to tell you 

i updated the acl as below :

acl half10001 random 0.0009980010000000

acl half10006 random 0.0009930209650350

acl half10011 random 0.0009880657804942

acl half10020 random 0.0009792086759647

acl half10037 random 0.0009626946373158

acl half10043 random 0.0009569328906720

acl half10059 random 0.0009417362622232

acl half10079 random 0.0009230793978373

acl half10082 random 0.0009203129279589

acl half10084 random 0.0009184732224159

acl half10094 random 0.0009093297114627

acl half10098 random 0.0009056978449587

acl half10109 random 0.0008957848329039

acl half10113 random 0.0008922070646991

acl half10114 random 0.0008913148576344

acl half10122 random 0.0008842092457380

acl half10137 random 0.0008710385479118

acl half10154 random 0.0008563487636013

acl half10168 random 0.0008444374977929

acl half10171 random 0.0008419067177676

acl half10173 random 0.0008402237462388

acl half10218 random 0.0008032337005613

acl half10221 random 0.0008008264083574

acl half10222 random 0.0008000255819491

acl half10223 random 0.0007992255563671

acl half10227 random 0.0007960334462989

acl half10247 random 0.0007802631200941

acl half10248 random 0.0007794828569740

.

.

.

.

.

but the rotation is very bad and the outgoing ip now is the ip that is on my eth0 ipv6 address  only .

i mean the lists above not working at all and all request go with  1 ipv6 which is the ip that is on my eth0 address .

what wrong did i do ?

On Aug 28, 2016, at 11:04 AM, --Ahmad-- <ahmed.zaeem@xxxxxxxxxxxx> wrote:

thanks for reply 

how about the length of the number?

1/1000 to which digits should i round ??

4 or 5 6 digits ?

AS AN EXAMPLE the 1/1000 probabilities will have the acls as below :

0.001 0.000999 0.000998001 0.000997002999 0.000996005996001

the question is how many digits should i round ?

will squid understand the long digits ?

cheers

On Aug 28, 2016, at 2:38 AM, Alex Rousskov <rousskov@xxxxxxxxxxxxxxxxxxxxxxx> wrote:

On 08/27/2016 04:34 PM, --Ahmad-- wrote:

i guess i need to create probability 1/1000 for each ip.

Yes, but that is _not_ the same as 1/1000 probability for each
tcp_outgoing_address rule, unfortunately. tcp_outgoing_address rules are
evaluated top to bottom until the first matches. If you have N rules and
each rule has a 1/N probability of a match in isolation, then you will
get the following probabilities of a match when the rules are combined:

 rule #0: 1/N   -- good!
 rule #1: (1-1/N) * 1/N  -- which is not 1/N
 rule #2: (1-1/N) * (1-1/N) * 1/N  -- even less 1/N than rule #2 was
 rule #3: (1-1/N) * (1-1/N) * (1-1/N) * 1/N  -- and getting worse!
 ...

To simplify equations, let me denote 1/N as p and (1-1/N) as q. With
your incorrect 1/N ACLs, you get the following probabilities (I am just
rewriting the above using p and q):

 rule #0: p
 rule #1: q * p
 rule #2: q*q * p
 rule #3: q*q*q * p
 ...

If you are still unsure, consider the simple case of just 2 rules
(instead of 1000). You want the second rule to match 50% of the time. If
you give the second rule ACL the same 1/2 probability of a match, then
the second rule will only match 1/4 of the time because it will match
only when the previous rule did _not_ match (1/2) _and_ when its own ACL
matched (1/2): 1/2*1/2 = 1/4.


To compensate for the cumulative effect of rules evaluation, you need
rule i to have p/(q^i) probability of a match (where "q^i" is "q to the
power of i"). With that, you will always get the same probability of a
match (p) for each rule when that rule is evaluated:

 rule #0: p
 rule #1: q * p/q = p
 rule #2: q*q * p/(q*q) = p
 rule #3: q*q*q * p/(q*q*q) = p
 ...
 rule #998: q^998 * p/(q^998) = p

To avoid uncertainty, the last rule (rule #999 in the above notation)
should use the "all" ACL (i.e., it will always match).

how can i create the randomized acls ???

I suggest writing a script that generates 999 ACLs with correct p/(q^i)
probability and the corresponding tcp_outgoing_address lines to match them.

Please note that computing ~500 random ACL matches for each outgoing
Squid connection (or is it each request?) is not going to be
instantaneous! If you are worried about Squid performance, then you may
want to add custom Squid code to select a random or round-robin IP
address out of a pool of 1000 addresses instead.

[ It is not going to be easy, but if you do it right, the same new
configuration interface and underlying code can then be applied to other
similar tasks in Squid (e.g., selecting one of several load-balanced
ICAP services). In that case, it would be a welcomed feature that may be
officially accepted. If you decide to make this generally useful, then I
recommend getting your configuration design pre-approved on squid-dev
before you implement anything (or before you pay somebody else to
implement it)! ]

is my settings below is correct ??

No. Your ACL(s) and rule probabilities are wrong. See above.


HTH,

Alex.

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users

_______________________________________________
squid-users mailing list
squid-users@xxxxxxxxxxxxxxxxxxxxx
http://lists.squid-cache.org/listinfo/squid-users