[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frb1sV-v6ox6wVreCrcYMPMcngDrqw6DendgDwSVwDpg":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"3cc73901-f4ce-4d51-bf92-b5bded9e4011","article","ECMP：网络设备如何把流量分到多条同样好的路径？","ecmp-equal-cost-multipath","ECMP 利用多条等价路径分担流量，通常按流哈希保持顺序，在链路利用率、热点、故障收敛和映射稳定性之间做取舍。","一台路由器到同一个目的地，可能存在多条代价完全相同的路径。ECMP（Equal-Cost Multipath，等价多路径）就是利用这些路径分担流量：不再把所有数据塞到一条链路上，而是让多个路径共同工作。\n\n最简单的想象是把一条高速公路分成几条同样近的匝道。若把每个数据包轮流送入不同匝道，平均看似公平，却可能因为各包排队和传输时间不同而在终点乱序。TCP 或上层协议遇到严重乱序，可能误判为丢包，降低发送速率。\n\n所以工程实现通常按流而不是按包做哈希。源地址、目的地址、端口和协议等字段组合成流标识，同一流尽量固定在同一路径，不同流再分散到多个路径上。这样既能利用链路总容量，又能减少单个连接的包乱序。代价是大流可能压满一条链路，而其他链路仍有空余；哈希选择还要避免热点和极端碰撞。\n\nECMP 的难点不仅在转发，还在故障和变化。某条路径失效后，原有哈希映射可能大量重排，造成缓存失效、连接抖动和瞬时流量迁移。设备还要处理链路容量不对称、隧道封装、链路聚合和跨设备的路径一致性。监控中看到“总带宽够用”并不代表每条流都分配得均匀。\n\n理解 ECMP 后，网络负载均衡就不再是简单的轮询。它本质上是在“路径利用率、包顺序、映射稳定性和故障收敛”之间做取舍，适合用流级粒度把大量独立连接分摊到等价链路上。\n\n在云网络和数据中心里，ECMP 往往还会和链路聚合、隧道以及服务网格叠加。每一层都可能重新计算哈希，导致上层以为流量均匀、下层却出现热点。排查时要沿着完整路径确认哈希字段、路径权重和故障切换行为，而不是只看某台设备的端口利用率。\n\n因此，ECMP 的效果应以流级分布、链路利用率、乱序、重传和故障切换时间共同衡量。只看到“多条路径都亮着”并不代表实现正确；真正的目标是让并发流平稳分担，同时让单个连接在路径变化时保持可接受的顺序和延迟。\n\n资料来源：[RFC 2991：Multipath Issues in Unicast and Multicast Next-Hop Selection](https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc2991)","\u002Fuploads\u002F2026-09-26\u002F907d4235-110e-4fd7-8ea3-321d2a327995.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"RFC 2991：Multipath Issues in Next-Hop Selection","https:\u002F\u002Fdatatracker.ietf.org\u002Fdoc\u002Fhtml\u002Frfc2991","published",false,55,0,"2026-09-27T00:00:00.000Z","2026-09-26T16:26:28.031Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":70,"createdAt":71},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:55.563Z"]