Routing and analysis of http behaviour with wireshark makes so much joy and fun.

Wanna get even more fun?

Add DNS. Add loadbalancers.

Loadbalancers?

Hell Yeah!

VLAN X has it's own router and domain overrides to give a service a seperate IP pointing to a loadbalancer inside the VLAN X.

loadbalancer in VLAN X then has additional routes to point to loadbalancer in VLAN Y.

Which might then point to the service in VLAN Y or... point to another loadbalancer in VLAN Z.

I'm always amazed what a human mind can create....

If you think that's insane, then add HTTP keepalive and persistent connections.

I just love people who have no idea what they're doing but are able to create a clusterfuck of brainfuck....

Some sort of makeshift high availability setup?

@N00bPancakes I wish...

They just wanted to avoid routing.

So they use DNS and loadbalancers as an... "router replacement"....

@IntrusionCM Ban them from life.

@IntrusionCM

Oh jebus ...

@N00bPancakes Yeah...

We haven't come to the part of the "Why" yet.

It took around 3 hours to explain to me the "How"...

I think I understood it after half an hour but my brain didn't want to process it ^^

@IntrusionCM

So back in the day I used to do networking as a career. I worked closely with our team that supported load balances.

Almost inevitably every fuck up load balance wise was because some folks whose competency was as a developer (and I'm sure they were fine at that... I hope) just threw routes at shit until it worked. There was almost no underlying rhyme or reason anyone could ever come up with.

Literally they'd have physical equipment they routed around and they weren't aware of it until something else went down and they wondered why that other thing didn't take the traffic...

@N00bPancakes Yeah...

And I was wondering why the latencies seem to be troublesome "randomly"

That's some bone hurting juice.

Ho Li Shit o.O

@AtuM Nah...

*scratches head*

Don't continue reading except you want to hurt self.

They've "tried" to establish a seperation / firewalling. But were (not my words) "afraid the router couldn't handle the traffic".

Instead they "segregated" not via routing on a central firewall / route, but rather utilized loadbalancer's and DNS for it.

You've got service "elastic.local" (fictional).

You've got an environment "production", which is on it's own VLAN.

Instead of an central router / fw, you've now an loadbalancer in "production".

And an DNS server in "production".

DNS server in "production" makes sure that "elastic.local" points to an loadbalancer inside "production".

This loadbalancer has the additional routes to traverse to another VLAN.

In this VLAN you've got the same shitty setup - "elastic.local" points to another loadbalancer, but now with an IP address from the different VLAN.

(the VLAN from "production" points directly to the other loadbalancer in the other VLAN...)

and yeah.

the loadbalancer has ACLs based on IP addresses / DNS.

I'm so happy that I'll only need to advise it to burn it down till there's no atom left.

But really... Madness. Sheer utter madness.