Subject: RE: Apache SSL redundancy

From: [email-masked]
Date: Tue, 5 Feb 2002 13:04:25 -0000

>another caveat that i've found to be problematic is when going 
>from http to https (or the other way round) you can lose state 
>as you go from one machien to the other. The load balancers do 
>a pretty good job of the work, however, we've definitely seen 
>jumpage from aol and webtv clients, as well as IIRC earthlink 
>and mindspring==- where the routing is complex, and there can 
>be multiple public IPs that a single session proxy can come 
>from. I've seen requests from different IPs coming in with the 
>same cookie or session IDs.
>
>it's an imperfect solution, and we're still working on ours.
>
>One thing i've thought of doing has been to setup a linux-vs 
>cluster for the straight port-forwarding, then use 
>apache/mod_ssl to handle the ssl negotiations, and pass it on 
>to the real app server with mod_proxy.
 
I have heard that AOL change dial-up IPs every 3-4 seconds. I have no data
to back this up, but considering their large user base it wouldn't be
surprising as they'd need to ensure that there are no unused IPs out there
(although of course a user should be able to renew the lease on the IP they
already have, but there you go).

So what you've observed makes some kind of sense.

- 
John Airey
Internet systems support officer, ITCSD, Royal National Institute for the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

Agnostic (Greek) = Ignoramus (Latin)

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 

14th June 2002 is RNIB Look Loud Day - visit http://www.lookloud.org.uk to
find out all about it.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked]
Date: Tue, 5 Feb 2002 16:32:58

** Reply to note from [email-masked] Tue, 5 Feb 2002 13:04:25 -0000 
>   
> I have heard that AOL change dial-up IPs every 3-4 seconds. I have no
> data to back this up, but considering their large user base it
> wouldn't be surprising as they'd need to ensure that there are no
> unused IPs out there (although of course a user should be able to
> renew the lease on the IP they already have, but there you go).

I have seen the initial page request and the requests for images for
that page come from different AOL IP addresses.  You can't trust IP
addresses from the Internet to have any basis in reality.

Rick

Rick Widmer
Internet Marketing Specialists
http://www.developersdesk.com
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]