No Windows 2008 Server, em um servidor com 2 GB de RAM, quanto, a memória mínima recomendada para definir o tamanho total do arquivo de paginação, em MB, é de:
O resultado da conversão para binário dos números decimais 10 e -25, usando 8 bits com notação de complemento a dois é:
Os Sistemas Operacionais (S.O.) apresentam uma arquitetura que tem a seguinte forma:
O sistema de linguagem SQL (Structured Query Language, ou Linguagem de Consulta Estruturada) possui a seguinte característica:
Suponha um host com endereço IP 10.1.1.185 e máscara de sub-rede 255.255.255.128. A sub-rede à qual o host pertence, o endereço de broadcast e a faixa de IPs disponível para os hosts dessa sub-rede são, respectivamente:
São portas TCP padrão, sem criptografia, utilizadas pelos protocolos SMTP, IMAP e POP3, respectivamente:
A conversão do binário 11001111.01 para hexadecimal é:
Os certificados confiáveis são utilizados para garantir uma comunicação segura na Internet. A responsabilidade da Autoridade de Certificação (CA - Certification Authority) na comunicação segura na Internet é:
O protocolo Camada Segura de Sockets ou Secure Sockets Layers (SSL) é um padrão de segurança que atua da seguinte forma:
Em redes de computadores, o Protocolo de Resolução de Endereços (ARP – Address Resolution Protocol) está associado à fronteira das seguintes camadas do modelo OSI:
Em relação ao endereço IP 172.22.3.65, máscara 255.255.255.192, pode-se afirmar que:
O endereço de broadcast da rede a que pertence o endereço IP 145.77.88.4/22 é:
Dentre as tecnologias de armazenamento em redes de computadores “Network Attached Storage” (NAS) e “Storage Area Network” (SAN), a tecnologia SAN se destaca por:
Na configuração do MTA Postfix, normalmente configurados no arquivo main.cf, o parâmetro que limita o tamanho máximo de mensagem que o sistema aceitará é:
Para operar com grandes volumes de dados ou garantir uma alta disponibilidade no armazenamento, é necessário conhecimentos em Redundant Array of Independent Disks (RAID). Com o objetivo de promover uma alta disponibilidade de dados, um administrador decide investir na confiabilidade do armazenamento de um servidor com 4 (quatro) discos rígidos (hard disk) por meio do uso de RAID.
A tecnologia RAID que oferece a maior confiabilidade em caso de falhas simultâneas de disco é:
No Windows 2008 Server, o User Account Control (UAC) aumenta a segurança impedindo que usuários implementem mudanças inadvertidas nas configurações do sistema e bloqueia o computador para impedir que aplicativos não autorizados se instalem ou executem ações suspeitas.
O principal componente do UAC que determina como os administradores serão avisados da elevação é:
Levando em consideração o endereço 172.22.3.65, referente às redes ipv4, no qual existem redes públicas e privadas, assinale a opção que apresenta a classe a que pertence esse endereço e se é público ou privado.
O protocolo SSH permite a criação de ferramentas extremamente versáteis. Com ele é possível exportar e usar remotamente aplicativos gráficos e de texto, transportar outros protocolos internamente por meio de túneis estáticos (como o http e https), criar túneis dinâmicos para navegação assistida de browsers, entre outras funcionalidades.
Supondo que o gerente de um servidor OpenSSH configure o envio de pacotes automáticos, reduzindo a ociosidade da conexão, por meio do canal encriptado para manter abertas as conexões com os clientes, a diretriz que deve ser usada é:
A solução correta para que uma consulta sql retorne às agências que possuem média dos saldos aplicados em conta maior que 1200 é:
O nome e o número do sinal que destrói o processo receptor e não pode ser capturado, bloqueado ou ignorado são:
Um analista é chamado para verificar o porquê de um domínio não estar respondendo com o nome apropriado. Ele utiliza, por meio de um shell, ferramentas para consultas de DNS. Dentre as ferramentas abaixo relacionadas, a que não permite realizar tais verificações é:
O primeiro processo a ser executado depois do sistema operacional ser inicializado, que sempre possui o PID igual a 1, é denominado de:
Em um ambiente jboss 6, pode-se acessar o console web de gerenciamento utilizando a seguinte porta padrão, pré-definida na instalação:
O comando chmod modifica as permissões de um arquivo. Observe as permissões do arquivo de nome arquivo.txt, listado pelo comando ls com opção -l:
# ls -l arquivo.txt
-rw-rw-r-- 1 root root 23 Jan 3 18:04 arquivo.txt
Após a execução do comando chmod, as permissões do arquivo foram alteradas, conforme a seguir:
# ls -l arquivo.txt
-rwxrw-r-- 1 root root 23 Jan 3 18:04 arquivo.txt
Para que o arquivo.txt recebesse a letra “x” para o dono, permitindo a execução do arquivo, o comando executado foi:
Processos de automatização de tarefas mais complexas pode exigir a verificação de uma ação para a execução de uma segunda ação somente se a primeira apresentar erro.
Dentre as opções relacionadas abaixo, a que representa uma linha de script de bash que executará “comando02” somente se “comando01” apresentar erro é:
O daemon “cron” possui a função de gerenciar:
Os arquivos ficam organizados em pastas distintas chamadas diretórios. Observe os diretórios abaixo:
/bin – arquivos de configuração e inicialização críticos
/boot – Kernel e arquivos necessários para carregar o kernel
/dev – entradas de dispositivos para terminais, discos, modems, etc.
/etc – comandos necessários para mínima operação do sistemas
Assinale a opção que contém aqueles que estão com o conteúdo trocado.
O comando que permite executar outros comandos como administrador do sistema é:
Observe a estrutura abaixo:
wheel:*:10:root,evi,garth,trent
csstaff:*:100:lloyd,evi
student:*:200:dotty
De acordo com a estrutura do arquivo /etc/group, o conteúdo das colunas deve ser, respectivamente:
O iptables, como um firewall, pode manipular um pacote dentro do kernel, utilizando a tabela nat, que traduz endereços para que redes distintas possam se comunicar.
Nessa tabela, as chains que podem ser utilizadas são:
Deseja-se modificar a permissão do arquivo /home/uerj/teste.txt para que:
• O dono do arquivo tenha permissão de leitura escrita e execução;
• O grupo ao qual pertence ao usuário tenha permissão de leitura e execução;
• Os demais usuários tenham apenas permissão de leitura.
O comando a ser usado é:
Em um Servidor de DNS, no seu arquivo de configuração de zona, o parâmetro que permite que o servidor secundário busque, de tempos em tempos, a comunicação com o servidor primário é:
No servidor DNS, considerando os parâmetros do arquivo named.hosts do aplicativo Bind, a opção que não contém um registro de recurso é:
Suponha que no diretório /home/uerj/teste existam os subdiretórios d1, d2, d3, d4 e d5 e que, em cada um deles, exista um arquivo com o nome a.txt. Deseja-se fazer um script que mova o arquivo a.txt desses subdiretórios para o diretório /home/uerj/teste. Como todos os arquivos possuem o mesmo nome, deve-se renomeá-lo e adicionar o número do diretório ao nome do arquivo. Por exemplo, o arquivo /home/uerj/teste/d1/a.txt será movido para /home/uerj/teste/a1.txt enquanto que o arquivo /home/uerj/teste/d3/a.txt será movido para /home/uerj/teste/a3.txt.
O código do script que realiza esse procedimento é:
Em um servidor Ldap, pode-se utilizar a porta padrão 389 para suportar sessões criptografadas e não criptografadas, dependendo da solicitação do cliente, através do seguinte mecanismo:
O interpretador de comandos bash permite a verificação do status do encerramento do último comando ou função executado no script. Um exemplo de trecho de código fonte que verifica o valor desse status é:
Observe o comando abaixo:
PowerEdge-2850:~$ ps l
F UID PID PPID PRI NI VSZ RSS WCHAN STAT TTY TIME COMMAND
0 1000 3870 3860 20 0 8568 3236 wait Ss pts/1 0:00 bash
0 1000 4024 3870 20 0 2272 556 wait S pts/1 0:00 sh
0 1000 4025 4024 20 0 8568 3232 wait S pts/1 0:00 bash
0 1000 4043 4025 20 0 6500 768 - R+ pts/1 0:00 ps l
PowerEdge-2850:~$
Considere as afirmativas sobre a saída do comando e assinale a opção que contém as corretas.
1) todos os processos estão sendo rodados por um mesmo usuário
2) um dos processos ocupa há mais tempo a CPU
3) os processos “bash” possuem processos pai diferentes
4) todos têm a mesma prioridade
5) todos os processos estão esperando execução de outros processo
No postfix, para melhor segurança, pode-se implementar o método de autenticação SMTP, o qual requer que clientes de e-mail enviem um nome de usuário e uma senha ao servidor SMTP durante o diálogo SMTP, e, se a autenticação foi bem-sucedida, eles poderão começar a retransmitir.
No arquivo de configuração que controla o daemon do postfix, o parâmetro que deve ser alterado para que o mecanismo de autenticação seja habilitado é:
No gerenciamento de processos, operações ligadas ao I/O aguardam que uma determinada operação de I/O seja finalizada, com isso o processo entra em um estado em que não pode ser morto, para que não haja inconsistências. Pode-se ainda identificá-lo através do comando top na coluna status.
Este estado é:
Em servidor Web, Apache, para melhorar o desempenho e a performance em que o servidor não precise verificar em cada diretório a existência de um arquivo .htaccess, a diretiva que podemos usar é:
Here’s the first line of code ever written by a US president
Barack Obama just became the first US president to write a line of computer code (assuming George W. Bush never secretly indulged in PHP). At the White House yesterday, Obama sat down with students who were learning the fundamentals of JavaScript, the popular programming language used to create most web pages.
The line he wrote was:
moveForward(100);
“So I make the F in higher case?” Obama asked, correctly observing that JavaScript is case sensitive. “Semicolon?” (That semicolon is optional, but Obama apparently has a knack for recognizing JavaScript best practices.)
Obama was playing with a Code.org tutorial based on the popular Disney movie Frozen. In his line of code, the President called a function-moveForward-pre-defined by Code.org for the exercise.
Calling a function in JavaScript is simple: write its name exactly as it has been defined, followed by parentheses that contain its “arguments.” In this case, a single argument tells the program how many pixels to move a Frozen character forward. Because it’s measured in pixels, the argument has to be a number. If Obama had written moveForward(“three steps”), the program would have failed, offering only a cryptic error message and exposing the president to the near-perpetual state of frustration most software developers live in.
“This is Elsa?” Obama asked, referring to the movie’s main character.
Obama was promoting Computer Science Education Week and Code.org’s Hour of Code campaign, which encourages kids to try programming for at least one hour. “It turns out the concepts are not that complicated,” Obama told the students at the White House, though his attempt to explain it suggested otherwise:
“The basic concept behind coding is that you take zeros and ones, you take two numbers, yes or no, and those can be translated into electrical messages that then run through the computer…. So all it’s doing is it’s saying yes or no over and over again, and the computer’s powerful enough that it can read a really long set of instructions really quickly.”
Something like that.
Disponível em: http://qz.com/308904/heres-the-first-line-of-code-ever-written-by-a-us-president/
Quartz (9 de Dezembro de 2014) - Texto de Zachary M. Seward
A atividade desempenhada pelo Presidente Obama na Casa Branca foi:
Here’s the first line of code ever written by a US president
Barack Obama just became the first US president to write a line of computer code (assuming George W. Bush never secretly indulged in PHP). At the White House yesterday, Obama sat down with students who were learning the fundamentals of JavaScript, the popular programming language used to create most web pages.
The line he wrote was:
moveForward(100);
“So I make the F in higher case?” Obama asked, correctly observing that JavaScript is case sensitive. “Semicolon?” (That semicolon is optional, but Obama apparently has a knack for recognizing JavaScript best practices.)
Obama was playing with a Code.org tutorial based on the popular Disney movie Frozen. In his line of code, the President called a function-moveForward-pre-defined by Code.org for the exercise.
Calling a function in JavaScript is simple: write its name exactly as it has been defined, followed by parentheses that contain its “arguments.” In this case, a single argument tells the program how many pixels to move a Frozen character forward. Because it’s measured in pixels, the argument has to be a number. If Obama had written moveForward(“three steps”), the program would have failed, offering only a cryptic error message and exposing the president to the near-perpetual state of frustration most software developers live in.
“This is Elsa?” Obama asked, referring to the movie’s main character.
Obama was promoting Computer Science Education Week and Code.org’s Hour of Code campaign, which encourages kids to try programming for at least one hour. “It turns out the concepts are not that complicated,” Obama told the students at the White House, though his attempt to explain it suggested otherwise:
“The basic concept behind coding is that you take zeros and ones, you take two numbers, yes or no, and those can be translated into electrical messages that then run through the computer…. So all it’s doing is it’s saying yes or no over and over again, and the computer’s powerful enough that it can read a really long set of instructions really quickly.”
Something like that.
Disponível em: http://qz.com/308904/heres-the-first-line-of-code-ever-written-by-a-us-president/
Quartz (9 de Dezembro de 2014) - Texto de Zachary M. Seward
Enquanto programava, Obama observou e questionou, respectivamente, os seguintes aspectos:
Here’s the first line of code ever written by a US president
Barack Obama just became the first US president to write a line of computer code (assuming George W. Bush never secretly indulged in PHP). At the White House yesterday, Obama sat down with students who were learning the fundamentals of JavaScript, the popular programming language used to create most web pages.
The line he wrote was:
moveForward(100);
“So I make the F in higher case?” Obama asked, correctly observing that JavaScript is case sensitive. “Semicolon?” (That semicolon is optional, but Obama apparently has a knack for recognizing JavaScript best practices.)
Obama was playing with a Code.org tutorial based on the popular Disney movie Frozen. In his line of code, the President called a function-moveForward-pre-defined by Code.org for the exercise.
Calling a function in JavaScript is simple: write its name exactly as it has been defined, followed by parentheses that contain its “arguments.” In this case, a single argument tells the program how many pixels to move a Frozen character forward. Because it’s measured in pixels, the argument has to be a number. If Obama had written moveForward(“three steps”), the program would have failed, offering only a cryptic error message and exposing the president to the near-perpetual state of frustration most software developers live in.
“This is Elsa?” Obama asked, referring to the movie’s main character.
Obama was promoting Computer Science Education Week and Code.org’s Hour of Code campaign, which encourages kids to try programming for at least one hour. “It turns out the concepts are not that complicated,” Obama told the students at the White House, though his attempt to explain it suggested otherwise:
“The basic concept behind coding is that you take zeros and ones, you take two numbers, yes or no, and those can be translated into electrical messages that then run through the computer…. So all it’s doing is it’s saying yes or no over and over again, and the computer’s powerful enough that it can read a really long set of instructions really quickly.”
Something like that.
Disponível em: http://qz.com/308904/heres-the-first-line-of-code-ever-written-by-a-us-president/
Quartz (9 de Dezembro de 2014) - Texto de Zachary M. Seward
A explicação do Presidente Obama sobre os conceitos de programação e a percepção do autor do texto sobre essa explicação são, respectivamente:
Here’s the first line of code ever written by a US president
Barack Obama just became the first US president to write a line of computer code (assuming George W. Bush never secretly indulged in PHP). At the White House yesterday, Obama sat down with students who were learning the fundamentals of JavaScript, the popular programming language used to create most web pages.
The line he wrote was:
moveForward(100);
“So I make the F in higher case?” Obama asked, correctly observing that JavaScript is case sensitive. “Semicolon?” (That semicolon is optional, but Obama apparently has a knack for recognizing JavaScript best practices.)
Obama was playing with a Code.org tutorial based on the popular Disney movie Frozen. In his line of code, the President called a function-moveForward-pre-defined by Code.org for the exercise.
Calling a function in JavaScript is simple: write its name exactly as it has been defined, followed by parentheses that contain its “arguments.” In this case, a single argument tells the program how many pixels to move a Frozen character forward. Because it’s measured in pixels, the argument has to be a number. If Obama had written moveForward(“three steps”), the program would have failed, offering only a cryptic error message and exposing the president to the near-perpetual state of frustration most software developers live in.
“This is Elsa?” Obama asked, referring to the movie’s main character.
Obama was promoting Computer Science Education Week and Code.org’s Hour of Code campaign, which encourages kids to try programming for at least one hour. “It turns out the concepts are not that complicated,” Obama told the students at the White House, though his attempt to explain it suggested otherwise:
“The basic concept behind coding is that you take zeros and ones, you take two numbers, yes or no, and those can be translated into electrical messages that then run through the computer…. So all it’s doing is it’s saying yes or no over and over again, and the computer’s powerful enough that it can read a really long set of instructions really quickly.”
Something like that.
Disponível em: http://qz.com/308904/heres-the-first-line-of-code-ever-written-by-a-us-president/
Quartz (9 de Dezembro de 2014) - Texto de Zachary M. Seward
O exercício de programação que o Presidente Obama estava fazendo tinha o objetivo de mover um personagem da Disney para frente. Para isso, a função moveForward deveria ser usada.
A distância que o personagem deveria ser movido para frente e os parâmetros da função são, respectivamente:
Virtual network appliances: Benefits and drawbacks
There's lots of talk about network virtualization benefits, but are virtual network appliances all they're cracked up to be? Only in some scenarios.
Network virtualization benefits can be plentiful, but only in certain scenarios. Learn where virtual network appliances can work -- and where they can't.
If virtualization enables servers to be spun up and down on demand for cost efficiency and agility, wouldn't it make sense to implement virtual network components too? After all, virtual servers need to communicate inbound and outbound and still be firewall-protected and load balanced. That would seem to be best addressed by virtual network appliances that can be spun-up on demand, right? Only in some scenarios.
Many networking vendors have already begun to minimize development cost by using Intel-based platforms and commodity hardware. Examples of this range from the Cisco ASA firewall to F5 load balancers and Vyatta routers. The obvious next step for some of these vendors has been to offer their products in virtual appliance packaging. F5 took a small step forward with the Local Traffic Manager - Virtual Edition (LTM VE), while Vyatta claims to offer a full range of virtual appliance solutions. VMware was somewhat late to the game, but it also offers virtualized firewalls (vShield Zones and vShield App) and routers/load balancers (vShield Edge).
Virtual network appliances: What's the catch?
The problem is that unlike servers, networking appliances commonly perform I/O-intensive tasks, moving large amounts of data between network interfaces with minimal additional processing, relying heavily on dedicated hardware. All high-speed routing and packet forwarding, as well as encryption (both IPsec and SSL) and load balancing, rely on dedicated silicon. When a networking appliance is repackaged into a virtual machine format, the dedicated hardware is gone, and all these tasks must now be performed by the general- purpose CPU, sometimes resulting in extreme reduction in performance.
Implementing routers, switches or firewalls in a virtual appliance would just burn the CPU cycles that could be better used elsewhere -- unless, of course, you’ve over-provisioned your servers and have plenty of idle CPU cycles, in which case something has gone seriously wrong with your planning.
To make matters worse, the hypervisor software used in server virtualization solutions also virtualizes the network interfaces. That means that every I/O access path to virtualized hardware from the networking appliance results in a context switch to higher privilege software (the hypervisor), which uses numerous CPU cycles to decode what needs to be done and emulate the desired action. Also, data passed between virtual machines must be copied between their address spaces, adding further latency to the process.
There is some help in that the VMware hypervisor has the DVFilter API, which allows a loadable kernel module to inspect and modify network traffic either within the hypervisor (vNetwork Data Path Agent) or in combination with a virtual machine (vNetwork Control Path Agent). The loadable kernel module significantly reduces the VM context switching overhead.
Where virtual network appliances can work?
There are some use cases in which virtual network appliances make perfect sense. For instance, you could virtualize an appliance that performs lots of CPU-intensive processing with no reliance on dedicated hardware. Web application firewalls (WAFs) and complex load balancers are perfect examples (no wonder they’re commonly implemented as loadable modules in Apache Web servers or as Squid reverse proxy servers).
Also, if you’re planning to roll out multi-tenant cloud, the flexibility gained by treating networking appliances as click-to-deploy Lego bricks might more than justify the subpar performance. This is especially so if you charge your users by their actual VM/CPU usage, in which case you don’t really care how much CPU they’re using.
Virtualized networking also makes sense when firewall and routing functions are implemented as part of the virtual switch in each hypervisor. This could result in optimal traffic flow between virtual machines (regardless of whether they belong to the same IP subnet or not) and solve the problem of traffic trombones. Unfortunately, it seems that Cisco is still the only vendor that extends the VMware hypervisor switch using the Virtual Ethernet Module (VEM) functionality. While numerous security solutions already deploy the VMsafe APIs, the networking appliances I’ve seen so far (including the vShield Edge from VMware) rely on virtual machines to forward traffic between virtual (or physical) LANs.
Obviously the networking vendors have a very long way to go before reaching the true potential of virtualized networking.
Disponível em: http://searchnetworking.techtarget.com/tip/Virtual-network-appliances-Benefits-and- drawbacks
Search Networking - Tech Target - Texto de Ivan Pepelnjak (Março de 2011)
Os tipos de aplicação de rede que fazem sentido com appliances de rede virtuais são:
Virtual network appliances: Benefits and drawbacks
There's lots of talk about network virtualization benefits, but are virtual network appliances all they're cracked up to be? Only in some scenarios.
Network virtualization benefits can be plentiful, but only in certain scenarios. Learn where virtual network appliances can work -- and where they can't.
If virtualization enables servers to be spun up and down on demand for cost efficiency and agility, wouldn't it make sense to implement virtual network components too? After all, virtual servers need to communicate inbound and outbound and still be firewall-protected and load balanced. That would seem to be best addressed by virtual network appliances that can be spun-up on demand, right? Only in some scenarios.
Many networking vendors have already begun to minimize development cost by using Intel-based platforms and commodity hardware. Examples of this range from the Cisco ASA firewall to F5 load balancers and Vyatta routers. The obvious next step for some of these vendors has been to offer their products in virtual appliance packaging. F5 took a small step forward with the Local Traffic Manager - Virtual Edition (LTM VE), while Vyatta claims to offer a full range of virtual appliance solutions. VMware was somewhat late to the game, but it also offers virtualized firewalls (vShield Zones and vShield App) and routers/load balancers (vShield Edge).
Virtual network appliances: What's the catch?
The problem is that unlike servers, networking appliances commonly perform I/O-intensive tasks, moving large amounts of data between network interfaces with minimal additional processing, relying heavily on dedicated hardware. All high-speed routing and packet forwarding, as well as encryption (both IPsec and SSL) and load balancing, rely on dedicated silicon. When a networking appliance is repackaged into a virtual machine format, the dedicated hardware is gone, and all these tasks must now be performed by the general- purpose CPU, sometimes resulting in extreme reduction in performance.
Implementing routers, switches or firewalls in a virtual appliance would just burn the CPU cycles that could be better used elsewhere -- unless, of course, you’ve over-provisioned your servers and have plenty of idle CPU cycles, in which case something has gone seriously wrong with your planning.
To make matters worse, the hypervisor software used in server virtualization solutions also virtualizes the network interfaces. That means that every I/O access path to virtualized hardware from the networking appliance results in a context switch to higher privilege software (the hypervisor), which uses numerous CPU cycles to decode what needs to be done and emulate the desired action. Also, data passed between virtual machines must be copied between their address spaces, adding further latency to the process.
There is some help in that the VMware hypervisor has the DVFilter API, which allows a loadable kernel module to inspect and modify network traffic either within the hypervisor (vNetwork Data Path Agent) or in combination with a virtual machine (vNetwork Control Path Agent). The loadable kernel module significantly reduces the VM context switching overhead.
Where virtual network appliances can work?
There are some use cases in which virtual network appliances make perfect sense. For instance, you could virtualize an appliance that performs lots of CPU-intensive processing with no reliance on dedicated hardware. Web application firewalls (WAFs) and complex load balancers are perfect examples (no wonder they’re commonly implemented as loadable modules in Apache Web servers or as Squid reverse proxy servers).
Also, if you’re planning to roll out multi-tenant cloud, the flexibility gained by treating networking appliances as click-to-deploy Lego bricks might more than justify the subpar performance. This is especially so if you charge your users by their actual VM/CPU usage, in which case you don’t really care how much CPU they’re using.
Virtualized networking also makes sense when firewall and routing functions are implemented as part of the virtual switch in each hypervisor. This could result in optimal traffic flow between virtual machines (regardless of whether they belong to the same IP subnet or not) and solve the problem of traffic trombones. Unfortunately, it seems that Cisco is still the only vendor that extends the VMware hypervisor switch using the Virtual Ethernet Module (VEM) functionality. While numerous security solutions already deploy the VMsafe APIs, the networking appliances I’ve seen so far (including the vShield Edge from VMware) rely on virtual machines to forward traffic between virtual (or physical) LANs.
Obviously the networking vendors have a very long way to go before reaching the true potential of virtualized networking.
Disponível em: http://searchnetworking.techtarget.com/tip/Virtual-network-appliances-Benefits-and- drawbacks
Search Networking - Tech Target - Texto de Ivan Pepelnjak (Março de 2011)
O software hipervisor usado em soluções de virtualização de servidores também virtualiza as interfaces de rede. Uma consequência que isso tem para o appliance de rede virtual é:
Virtual network appliances: Benefits and drawbacks
There's lots of talk about network virtualization benefits, but are virtual network appliances all they're cracked up to be? Only in some scenarios.
Network virtualization benefits can be plentiful, but only in certain scenarios. Learn where virtual network appliances can work -- and where they can't.
If virtualization enables servers to be spun up and down on demand for cost efficiency and agility, wouldn't it make sense to implement virtual network components too? After all, virtual servers need to communicate inbound and outbound and still be firewall-protected and load balanced. That would seem to be best addressed by virtual network appliances that can be spun-up on demand, right? Only in some scenarios.
Many networking vendors have already begun to minimize development cost by using Intel-based platforms and commodity hardware. Examples of this range from the Cisco ASA firewall to F5 load balancers and Vyatta routers. The obvious next step for some of these vendors has been to offer their products in virtual appliance packaging. F5 took a small step forward with the Local Traffic Manager - Virtual Edition (LTM VE), while Vyatta claims to offer a full range of virtual appliance solutions. VMware was somewhat late to the game, but it also offers virtualized firewalls (vShield Zones and vShield App) and routers/load balancers (vShield Edge).
Virtual network appliances: What's the catch?
The problem is that unlike servers, networking appliances commonly perform I/O-intensive tasks, moving large amounts of data between network interfaces with minimal additional processing, relying heavily on dedicated hardware. All high-speed routing and packet forwarding, as well as encryption (both IPsec and SSL) and load balancing, rely on dedicated silicon. When a networking appliance is repackaged into a virtual machine format, the dedicated hardware is gone, and all these tasks must now be performed by the general- purpose CPU, sometimes resulting in extreme reduction in performance.
Implementing routers, switches or firewalls in a virtual appliance would just burn the CPU cycles that could be better used elsewhere -- unless, of course, you’ve over-provisioned your servers and have plenty of idle CPU cycles, in which case something has gone seriously wrong with your planning.
To make matters worse, the hypervisor software used in server virtualization solutions also virtualizes the network interfaces. That means that every I/O access path to virtualized hardware from the networking appliance results in a context switch to higher privilege software (the hypervisor), which uses numerous CPU cycles to decode what needs to be done and emulate the desired action. Also, data passed between virtual machines must be copied between their address spaces, adding further latency to the process.
There is some help in that the VMware hypervisor has the DVFilter API, which allows a loadable kernel module to inspect and modify network traffic either within the hypervisor (vNetwork Data Path Agent) or in combination with a virtual machine (vNetwork Control Path Agent). The loadable kernel module significantly reduces the VM context switching overhead.
Where virtual network appliances can work?
There are some use cases in which virtual network appliances make perfect sense. For instance, you could virtualize an appliance that performs lots of CPU-intensive processing with no reliance on dedicated hardware. Web application firewalls (WAFs) and complex load balancers are perfect examples (no wonder they’re commonly implemented as loadable modules in Apache Web servers or as Squid reverse proxy servers).
Also, if you’re planning to roll out multi-tenant cloud, the flexibility gained by treating networking appliances as click-to-deploy Lego bricks might more than justify the subpar performance. This is especially so if you charge your users by their actual VM/CPU usage, in which case you don’t really care how much CPU they’re using.
Virtualized networking also makes sense when firewall and routing functions are implemented as part of the virtual switch in each hypervisor. This could result in optimal traffic flow between virtual machines (regardless of whether they belong to the same IP subnet or not) and solve the problem of traffic trombones. Unfortunately, it seems that Cisco is still the only vendor that extends the VMware hypervisor switch using the Virtual Ethernet Module (VEM) functionality. While numerous security solutions already deploy the VMsafe APIs, the networking appliances I’ve seen so far (including the vShield Edge from VMware) rely on virtual machines to forward traffic between virtual (or physical) LANs.
Obviously the networking vendors have a very long way to go before reaching the true potential of virtualized networking.
Disponível em: http://searchnetworking.techtarget.com/tip/Virtual-network-appliances-Benefits-and- drawbacks
Search Networking - Tech Target - Texto de Ivan Pepelnjak (Março de 2011)
Os exemplos de aplicações que fazem sentido com appliances de rede virtuais são:
Virtual network appliances: Benefits and drawbacks
There's lots of talk about network virtualization benefits, but are virtual network appliances all they're cracked up to be? Only in some scenarios.
Network virtualization benefits can be plentiful, but only in certain scenarios. Learn where virtual network appliances can work -- and where they can't.
If virtualization enables servers to be spun up and down on demand for cost efficiency and agility, wouldn't it make sense to implement virtual network components too? After all, virtual servers need to communicate inbound and outbound and still be firewall-protected and load balanced. That would seem to be best addressed by virtual network appliances that can be spun-up on demand, right? Only in some scenarios.
Many networking vendors have already begun to minimize development cost by using Intel-based platforms and commodity hardware. Examples of this range from the Cisco ASA firewall to F5 load balancers and Vyatta routers. The obvious next step for some of these vendors has been to offer their products in virtual appliance packaging. F5 took a small step forward with the Local Traffic Manager - Virtual Edition (LTM VE), while Vyatta claims to offer a full range of virtual appliance solutions. VMware was somewhat late to the game, but it also offers virtualized firewalls (vShield Zones and vShield App) and routers/load balancers (vShield Edge).
Virtual network appliances: What's the catch?
The problem is that unlike servers, networking appliances commonly perform I/O-intensive tasks, moving large amounts of data between network interfaces with minimal additional processing, relying heavily on dedicated hardware. All high-speed routing and packet forwarding, as well as encryption (both IPsec and SSL) and load balancing, rely on dedicated silicon. When a networking appliance is repackaged into a virtual machine format, the dedicated hardware is gone, and all these tasks must now be performed by the general- purpose CPU, sometimes resulting in extreme reduction in performance.
Implementing routers, switches or firewalls in a virtual appliance would just burn the CPU cycles that could be better used elsewhere -- unless, of course, you’ve over-provisioned your servers and have plenty of idle CPU cycles, in which case something has gone seriously wrong with your planning.
To make matters worse, the hypervisor software used in server virtualization solutions also virtualizes the network interfaces. That means that every I/O access path to virtualized hardware from the networking appliance results in a context switch to higher privilege software (the hypervisor), which uses numerous CPU cycles to decode what needs to be done and emulate the desired action. Also, data passed between virtual machines must be copied between their address spaces, adding further latency to the process.
There is some help in that the VMware hypervisor has the DVFilter API, which allows a loadable kernel module to inspect and modify network traffic either within the hypervisor (vNetwork Data Path Agent) or in combination with a virtual machine (vNetwork Control Path Agent). The loadable kernel module significantly reduces the VM context switching overhead.
Where virtual network appliances can work?
There are some use cases in which virtual network appliances make perfect sense. For instance, you could virtualize an appliance that performs lots of CPU-intensive processing with no reliance on dedicated hardware. Web application firewalls (WAFs) and complex load balancers are perfect examples (no wonder they’re commonly implemented as loadable modules in Apache Web servers or as Squid reverse proxy servers).
Also, if you’re planning to roll out multi-tenant cloud, the flexibility gained by treating networking appliances as click-to-deploy Lego bricks might more than justify the subpar performance. This is especially so if you charge your users by their actual VM/CPU usage, in which case you don’t really care how much CPU they’re using.
Virtualized networking also makes sense when firewall and routing functions are implemented as part of the virtual switch in each hypervisor. This could result in optimal traffic flow between virtual machines (regardless of whether they belong to the same IP subnet or not) and solve the problem of traffic trombones. Unfortunately, it seems that Cisco is still the only vendor that extends the VMware hypervisor switch using the Virtual Ethernet Module (VEM) functionality. While numerous security solutions already deploy the VMsafe APIs, the networking appliances I’ve seen so far (including the vShield Edge from VMware) rely on virtual machines to forward traffic between virtual (or physical) LANs.
Obviously the networking vendors have a very long way to go before reaching the true potential of virtualized networking.
Disponível em: http://searchnetworking.techtarget.com/tip/Virtual-network-appliances-Benefits-and- drawbacks
Search Networking - Tech Target - Texto de Ivan Pepelnjak (Março de 2011)
Existem requisitos de hardware ao virtualizar aplicações de aplicações de roteamento e encaminhamento de pacotes e encriptação.
O requisito de hardware necessário e o desempenho esperado das aplicações são, respectivamente:
Virtual network appliances: Benefits and drawbacks
There's lots of talk about network virtualization benefits, but are virtual network appliances all they're cracked up to be? Only in some scenarios.
Network virtualization benefits can be plentiful, but only in certain scenarios. Learn where virtual network appliances can work -- and where they can't.
If virtualization enables servers to be spun up and down on demand for cost efficiency and agility, wouldn't it make sense to implement virtual network components too? After all, virtual servers need to communicate inbound and outbound and still be firewall-protected and load balanced. That would seem to be best addressed by virtual network appliances that can be spun-up on demand, right? Only in some scenarios.
Many networking vendors have already begun to minimize development cost by using Intel-based platforms and commodity hardware. Examples of this range from the Cisco ASA firewall to F5 load balancers and Vyatta routers. The obvious next step for some of these vendors has been to offer their products in virtual appliance packaging. F5 took a small step forward with the Local Traffic Manager - Virtual Edition (LTM VE), while Vyatta claims to offer a full range of virtual appliance solutions. VMware was somewhat late to the game, but it also offers virtualized firewalls (vShield Zones and vShield App) and routers/load balancers (vShield Edge).
Virtual network appliances: What's the catch?
The problem is that unlike servers, networking appliances commonly perform I/O-intensive tasks, moving large amounts of data between network interfaces with minimal additional processing, relying heavily on dedicated hardware. All high-speed routing and packet forwarding, as well as encryption (both IPsec and SSL) and load balancing, rely on dedicated silicon. When a networking appliance is repackaged into a virtual machine format, the dedicated hardware is gone, and all these tasks must now be performed by the general- purpose CPU, sometimes resulting in extreme reduction in performance.
Implementing routers, switches or firewalls in a virtual appliance would just burn the CPU cycles that could be better used elsewhere -- unless, of course, you’ve over-provisioned your servers and have plenty of idle CPU cycles, in which case something has gone seriously wrong with your planning.
To make matters worse, the hypervisor software used in server virtualization solutions also virtualizes the network interfaces. That means that every I/O access path to virtualized hardware from the networking appliance results in a context switch to higher privilege software (the hypervisor), which uses numerous CPU cycles to decode what needs to be done and emulate the desired action. Also, data passed between virtual machines must be copied between their address spaces, adding further latency to the process.
There is some help in that the VMware hypervisor has the DVFilter API, which allows a loadable kernel module to inspect and modify network traffic either within the hypervisor (vNetwork Data Path Agent) or in combination with a virtual machine (vNetwork Control Path Agent). The loadable kernel module significantly reduces the VM context switching overhead.
Where virtual network appliances can work?
There are some use cases in which virtual network appliances make perfect sense. For instance, you could virtualize an appliance that performs lots of CPU-intensive processing with no reliance on dedicated hardware. Web application firewalls (WAFs) and complex load balancers are perfect examples (no wonder they’re commonly implemented as loadable modules in Apache Web servers or as Squid reverse proxy servers).
Also, if you’re planning to roll out multi-tenant cloud, the flexibility gained by treating networking appliances as click-to-deploy Lego bricks might more than justify the subpar performance. This is especially so if you charge your users by their actual VM/CPU usage, in which case you don’t really care how much CPU they’re using.
Virtualized networking also makes sense when firewall and routing functions are implemented as part of the virtual switch in each hypervisor. This could result in optimal traffic flow between virtual machines (regardless of whether they belong to the same IP subnet or not) and solve the problem of traffic trombones. Unfortunately, it seems that Cisco is still the only vendor that extends the VMware hypervisor switch using the Virtual Ethernet Module (VEM) functionality. While numerous security solutions already deploy the VMsafe APIs, the networking appliances I’ve seen so far (including the vShield Edge from VMware) rely on virtual machines to forward traffic between virtual (or physical) LANs.
Obviously the networking vendors have a very long way to go before reaching the true potential of virtualized networking.
Disponível em: http://searchnetworking.techtarget.com/tip/Virtual-network-appliances-Benefits-and- drawbacks
Search Networking - Tech Target - Texto de Ivan Pepelnjak (Março de 2011)
O texto apresenta vantagem do uso de plataforma baseada em intel para dispositivos de rede. A vantagem e o próximo passo adotado pelas empresas são, respectivamente:
Virtual network appliances: Benefits and drawbacks
There's lots of talk about network virtualization benefits, but are virtual network appliances all they're cracked up to be? Only in some scenarios.
Network virtualization benefits can be plentiful, but only in certain scenarios. Learn where virtual network appliances can work -- and where they can't.
If virtualization enables servers to be spun up and down on demand for cost efficiency and agility, wouldn't it make sense to implement virtual network components too? After all, virtual servers need to communicate inbound and outbound and still be firewall-protected and load balanced. That would seem to be best addressed by virtual network appliances that can be spun-up on demand, right? Only in some scenarios.
Many networking vendors have already begun to minimize development cost by using Intel-based platforms and commodity hardware. Examples of this range from the Cisco ASA firewall to F5 load balancers and Vyatta routers. The obvious next step for some of these vendors has been to offer their products in virtual appliance packaging. F5 took a small step forward with the Local Traffic Manager - Virtual Edition (LTM VE), while Vyatta claims to offer a full range of virtual appliance solutions. VMware was somewhat late to the game, but it also offers virtualized firewalls (vShield Zones and vShield App) and routers/load balancers (vShield Edge).
Virtual network appliances: What's the catch?
The problem is that unlike servers, networking appliances commonly perform I/O-intensive tasks, moving large amounts of data between network interfaces with minimal additional processing, relying heavily on dedicated hardware. All high-speed routing and packet forwarding, as well as encryption (both IPsec and SSL) and load balancing, rely on dedicated silicon. When a networking appliance is repackaged into a virtual machine format, the dedicated hardware is gone, and all these tasks must now be performed by the general- purpose CPU, sometimes resulting in extreme reduction in performance.
Implementing routers, switches or firewalls in a virtual appliance would just burn the CPU cycles that could be better used elsewhere -- unless, of course, you’ve over-provisioned your servers and have plenty of idle CPU cycles, in which case something has gone seriously wrong with your planning.
To make matters worse, the hypervisor software used in server virtualization solutions also virtualizes the network interfaces. That means that every I/O access path to virtualized hardware from the networking appliance results in a context switch to higher privilege software (the hypervisor), which uses numerous CPU cycles to decode what needs to be done and emulate the desired action. Also, data passed between virtual machines must be copied between their address spaces, adding further latency to the process.
There is some help in that the VMware hypervisor has the DVFilter API, which allows a loadable kernel module to inspect and modify network traffic either within the hypervisor (vNetwork Data Path Agent) or in combination with a virtual machine (vNetwork Control Path Agent). The loadable kernel module significantly reduces the VM context switching overhead.
Where virtual network appliances can work?
There are some use cases in which virtual network appliances make perfect sense. For instance, you could virtualize an appliance that performs lots of CPU-intensive processing with no reliance on dedicated hardware. Web application firewalls (WAFs) and complex load balancers are perfect examples (no wonder they’re commonly implemented as loadable modules in Apache Web servers or as Squid reverse proxy servers).
Also, if you’re planning to roll out multi-tenant cloud, the flexibility gained by treating networking appliances as click-to-deploy Lego bricks might more than justify the subpar performance. This is especially so if you charge your users by their actual VM/CPU usage, in which case you don’t really care how much CPU they’re using.
Virtualized networking also makes sense when firewall and routing functions are implemented as part of the virtual switch in each hypervisor. This could result in optimal traffic flow between virtual machines (regardless of whether they belong to the same IP subnet or not) and solve the problem of traffic trombones. Unfortunately, it seems that Cisco is still the only vendor that extends the VMware hypervisor switch using the Virtual Ethernet Module (VEM) functionality. While numerous security solutions already deploy the VMsafe APIs, the networking appliances I’ve seen so far (including the vShield Edge from VMware) rely on virtual machines to forward traffic between virtual (or physical) LANs.
Obviously the networking vendors have a very long way to go before reaching the true potential of virtualized networking.
Disponível em: http://searchnetworking.techtarget.com/tip/Virtual-network-appliances-Benefits-and- drawbacks
Search Networking - Tech Target - Texto de Ivan Pepelnjak (Março de 2011)
O texto II faz um comentário sobre o uso de appliances de rede virtuais em “multi-tenant cloud”. Com base nesse comentário, é possível concluir que: