Load-balancing AOL addresses

IP address randomization messing up our load balancing

[glauber]

Our site is load-balanced through an Alteon switch. We weren't able to use cookie-based persistence because the Alteon got confused when we went into SSH to process the users's credit card info, so we changed to a form of IP-hashing ("minmiss" or something such). The load balancer applies a hashing algorythm to the client IP address to decide which server processes the request.

This worked great until we started getting a lot of complaints from AOL users. We did some research and it looks like AOL randomizes the originating IP address (each request may be coming from a different IP), completely messing up the IP-based load balancing. So we had to turn off the load balancing until we figure this out. :(

We can't be the first site to be having this kind of problem. Does anybody here has any suggestions?

The load balancer is Alteon Ace Director 3. It seems that this switch needs a piece of helper hardware in order to be able to do cookie-based persistence with SSL, and our ISP (Verio) has no plans to get this hardware.

One think i'm wondering is if it's possible to do the IP-based load balanced for most addresses, but single out the AOL subnets and hardcode them to one of the servers.

Thanks for any ideas and suggestions.

Glauber

[toolman]

I can't even begin to answer that heavy hardware question but I would like to add one observation.

AOL recently changed something in the way that make requests. About two weeks ago I started noticing a dramatic increase in AOL traffic but closer analysis shows it to be separate IP's requesting files on what appears to be the same request. In other words different IP's fetching different parts of the same page. This all started the same time they started the new results thing they're doing at their search page.

[glauber]

Yes, this is the exact same problem we have. It seems that this has been always the case, though maybe it got worse recently.

It seems that their (AOLs) proxy actually makes the request, using a batch of IP addresses that have nothing to do with the real IP address of the person surfing.

I emailed AOL this morning and got a perfectly useless reply. I'll try calling them on the phone.

g

[Brett_Tabke]

What did the supplier of the load balancer have to say about it?

Proxy cache info: (nothing too technical though).
[webmaster.aol.com...]

There are several ISP around the global that use the same system.

What did Alteon say about the cookie confusion? Why would it filter cookies?

[glauber]

What did Alteon have to say about this? That they will gladly sell Verio another device that for about $10K will attach to the load balancer and allow it to understand SSL.

And i'm not making this up.

Since Tomcat (Java) is what really cares about sessions, we're looking into ways to make the each Apache able to talk to each Tomcat, and make the Apache track the session. It's not working yet. :(