Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

github.com

Post reply on HN
Print view View original

1–10 of 40 posts

Re: Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

#2

Post by nodesocket »

> I had the wrong ciphers configured. After some quick tweaking and a confirmation using openssl s_client -connect server:ip

Is this in the nginx config? Can anybody elaborate a bit further? Here is what I am currently using in my nginx config for ssl:

    ssl_session_cache shared:SSL_CACHE:8m;
    ssl_session_timeout 5m;

    # Mitigate BEAST attacks
    ssl_ciphers RC4:HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

Re: Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

#3

Post by wereHamster »

nodesocket wrote: post #2

> I had the wrong ciphers configured. After some quick tweaking and a confirmation using openssl s_client -connect server:ip Is this in the nginx config? Can anybody elaborate a bit further? Here is what I am currently using in my nginx config for ssl: ssl_session_cache shared:SSL_CACHE:8m; ssl_session_timeout 5m; # Mitigate BEAST attacks ssl_ciphers RC4:HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;

Uhm.. https://github.com/observing/balancerbattle/blob/master/ngin... ?

Re: Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

#5

Post by V1 »

nodesocket wrote: post #2

> I had the wrong ciphers configured. After some quick tweaking and a confirmation using openssl s_client -connect server:ip Is this in the nginx config? Can anybody elaborate a bit further? Here is what I am currently using in my nginx config for ssl: ssl_session_cache shared:SSL_CACHE:8m; ssl_session_timeout 5m; # Mitigate BEAST attacks ssl_ciphers RC4:HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on;

Are you referring to the cipher verification? I used:

  openssl s_client -host localhost -port 8082
Which is a openssl command. These settings were used for testing SSL: https://github.com/observing/balancerbattle/blob/master/ngin...

See https://gist.github.com/3rd-Eden/5345018 for the output of the openssl s_client for those ciphers. You'll see that `cipher : RC4-SHA` is used here. Which is one of the fastest if not the fastest cipher available.

Re: Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

#6

Post by laumars »

otterley wrote: post #4

How many requests are made per connection? In order to better gauge performance we need a 3-axis plot, where the response rate is measured against various request-per-connection values and connection rates.

Before each test all WebSocketServer is reset and the Proxy re-initiated. Thor will hammer all the Proxy server with x amount of connection with a concurrency of 100. For each established connection one single UTF-8 message is send and received. After the message is received the connection is closed.

source: https://github.com/observing/balancerbattle#benchmarking

Re: Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

#7

Post by gyepi »

> nginx and haproxy were really close, it's almost not significant enough to say that one is faster or better then the other. But if you look at it from an operations stand point. It's easier to deploy and manage a single nginx server instead of stud and haproxy

From an operations standpoint, haproxy has other features (failover, cli management, clustering) that actually makes it a much better load balancer. I usually install all three haproxy, stud, nginx because they are each very good in their specific niche. As for the simplicity of installation, that can be handled with a configuration manager.

Re: Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

#8

Post by jsmeaton »

It would be interesting to see the difference with HAProxy if this line was removed: https://github.com/observing/balancerbattle/blob/master/hapr...

What the option does is close the connection between the proxy and the backend so that HAProxy will analyse further requests instead of just forwarding to the already established connection.

To be fair, I don't know what nginx does - whether connections are kept open or shut down - so I'm not sure that it'd be a fair comparison.

Also interesting are the HAProxy built in SSL times. I'm surprised they're so slow. Perhaps the cipher is also the culprit. The cipher can also be specified in HAProxy.

  bind *:8080 ssl crt /root/balancerbattle/ssl/combined.pem ciphers RC4-SHA:AES128-SHA:AES:!ADH:!aNULL:!DH:!EDH:!eNULL

Re: Balancer Battle – Load testing HAproxy, Nginx and HTTP-Proxy's WebSocket support

#10

Post by V1 »

devicenull wrote: post #9

Why do people always benchmark on virtual machines running on someone else's server, and expect meaningful results?

Because we people obviously don't have a datacenter in our own basement. And the common mistake people make when benchmarking is running the servers on their own machine and then use the same machine to benchmark the server it's running.

You need to have multiple (powerful) machines for this. And also, spinning up machines in the cloud is quite easy to do and allows people to reproduce the same test results because you have access to exactly the same environment.

Post reply on HN