How akamai works

Here are my conjectures on how Akamai works. These are based on some experiments done on April 4th, 2000 using mainly "dig". These were conducted from some machines at UW and one at MIT.

1. What an Akamaized page looks like?

Suppose you enter www.cnn.com in your browser. This fetches the index.html file from the cnn server. In that file there will be images which will be pointing to the Akamai servers. Those URLs look like

http://a388.g.akamaitech.net/7/388/21/fc35ed7f236388/cnn.com/images/hub2000/ad.info.gif
http://a1380.g.akamaitech.net/7/1380/175/03202000/www1.jcpenney.com/images/homepagev4/homepage/catalog.gif
http://a620.g.akamai.net/7/620/16/259fdbf4ed29de/www.computer.com/images/learn_more_off.gif

• The number after "a", I think, identifies the customer. So 388 is cnn, 1380 is jcpenny and 620 is computer.com. Note that it is crucial to have different machine name for each customer as will become clear later.
• I am not sure what 7 stands for but it was present in almost of the Akamaized URLs I saw.
• Next is again the customer identifier.
• What the following  two identifiers (21 and  fade2068e7503e for cnn) represent is not fully clear. A plausible explanation (courtesy Neal Cardwell ) is  that the 14 digit hex strings are checksums of the content that path refers to. That way the name always changes if the content changes so the akamai caches at the edge don't have to worry about consistency or freshness.

* update (courtesy John Jacob ): The hex string is created using "md5sum [file_name] |  cut -c3-16". It can also be replaced by a cache time-to -live value like "1d" for one day,  and "15m" for 15 mins.
• Next is the customer url itself. The path after that is identical to the path on the customer machine. So the above jcpenny URL and "www1.jcpenney.com/images/homepagev4/homepage/catalog.gif " lead to the same gif.

Getting a web site in the above form is not too tough either. Akamai has a simple tool, Free Flow Launcher, for its customers that they use to Akamaize their pages. The users will specify what content they want to be served through Akamai and the tool will go ahead and Akamaize the URLs. This way the customers still have complete control of what gets served through Akamai and what they still are in charge of. Typicall all the dynamic content and stuff like transactions and cookies are taken by of by the customer's server only. Now the customer is responsible only for the content he choses to server himself and first few hits of other content till the Akamai caches warm up.

2. DNS Black Magic

I do not know the DNS system inside out, so the information here could be incomplete or simply wrong. Believe it at your own risk. Below is the chronology of steps that happen when an object from an Akamai server is to be fetched.

Step 1

From the top level domain you first get the name server of akamaitech.net domain. Interesting things happen here itself. There are 8 name servers reported z[A-H].akamaitech.net  This information obtained is good on the scale of days.

Below is part of "dig" output.
The columns are <Machine-Name> <Lifetime of cached information> <IN (for query-type)> <A (for query-class)> <IP Address.
(There is no need to worry about the query type and query class here.)

@MIT
ZA.akamaitech.NET.      3h30m6s      IN A    216.200.14.134
ZB.akamaitech.NET.      3h30m6s      IN A    204.178.107.226
ZC.akamaitech.NET.      3h30m6s      IN A    209.189.112.38
ZD.akamaitech.NET.      3h30m2s     IN A    216.200.119.8
ZE.akamaitech.NET.      3h30m2s      IN A    216.32.65.14
ZF.akamaitech.NET.      1d44m5s      IN A    128.11.47.240
ZG.akamaitech.NET.      23h24m25s IN A   209.185.188.14
ZH.akamaitech.NET.      23h24m25s IN A   204.178.110.73

@UW
zA.akamaitech.NET.      1d16m48s IN A   204.178.107.226
ZB.akamaitech.NET.      1d16m48s IN A   128.11.47.240
ZC.akamaitech.NET.      1d16m48s IN A   216.32.65.14
ZD.akamaitech.NET.      1d16m48s IN A   38.202.25.166
ZE.akamaitech.NET.      1d16m48s IN A   216.200.14.134
ZF.akamaitech.NET.      1d16m48s IN A   204.178.110.73
ZG.akamaitech.NET.      1d16m48s IN A   209.185.188.14
ZH.akamaitech.NET.      1d16m48s IN A   216.200.119.8

A couple of points are of interest here.

• The machines at MIT and UW see different information. This could be because they access different NET name servers.
• Another interesting observation here is that IP addresses in the two outputs are more or less (one exception) permutation of each other. What is achieved by having a different IP address for different names is not clear to me. But having the IP addresses returned in different order might achieve load balancing.

Step 2

From one of the name servers above you go and get the name servers for domain g.akamaitech.net. Now this step is where most of the stuff happens. A few observations about the information returned at this step.

•  The name servers are n[0-9]g.akamaitech.net.
• This information can be cached from 30mins to 1hour.
• The IP addresses of name servers returned are different for different client locations (IP addresses).
• The set of name server IPs returned to a particular client changes with time.  So if you access cnn.com at different times (separated by DNS cache expiry) you could be contacting different name servers and thus downloading objects from different servers.

Below is a part of dig output from MIT and one of the machines UW (the format of the output explained above)

@MIT
n1g.akamaitech.NET.     27m48s IN A     18.7.0.7
n2g.akamaitech.NET.     16m45s IN A     18.7.0.8
n7g.akamaitech.NET.     31m44s IN A     64.26.141.69
n3g.akamaitech.NET.     18m14s IN A     18.7.0.6
n4g.akamaitech.NET.     18m14s IN A     18.7.0.6
n8g.akamaitech.NET.     18m14s IN A     18.7.0.6
n5g.akamaitech.NET.     18m14s IN A     18.7.0.6
n0g.akamaitech.NET.     18m14s IN A     18.7.0.6
n6g.akamaitech.NET.     18m14s IN A     204.212.232.17

@UW
n2g.akamaitech.NET.     46m13s IN A     192.215.32.126
n3g.akamaitech.NET.     16m13s IN A     192.215.32.141
n8g.akamaitech.NET.     16m13s IN A     216.32.60.167
n4g.akamaitech.NET.     16m13s IN A     216.32.60.167
n5g.akamaitech.NET.     16m13s IN A     216.32.60.167
n6g.akamaitech.NET.     16m13s IN A     216.32.60.167
n0g.akamaitech.NET.     16m13s IN A     192.215.32.118
n1g.akamaitech.NET.     31m13s IN A     192.215.32.119
n7g.akamaitech.NET.     31m13s IN A     216.32.172.39

Note that all the IP addresses are not unique in a set. My take is that this makes future expansions easier with changed restricted to lesser places.

My belief is that this is THE step where all the Akamai DNS magic is. It will hand out different set of name server IPs to client contacting from different IP addresses. How it determines the nearest set of servers from IP addresses is anybody's guess (proprietary, but allegedly, they use BGP peering with ISPs that host the Akamai cluster, thus giving them a rough estimate of the distance of requesting user from that site - courtesy Tommy Larsen ). Apart from wire latency other factors they claim to consider are load on their servers and Internet congestion. They also claim to be able to monitor their servers in real time (once per second). This means that gives out different sets of name server IPs at different times, which explains the short lifetime (30mins - 1hour) of this information. For instance following is part of dig output from the same UW machine at different times (or even different machines at same time - see below).

@UW1
n2g.akamaitech.NET.     46m11s IN A     192.215.32.126
n3g.akamaitech.NET.     16m11s IN A     192.215.32.141
n8g.akamaitech.NET.     16m11s IN A     216.32.60.167
n4g.akamaitech.NET.     16m11s IN A     216.32.60.167
n5g.akamaitech.NET.     16m11s IN A     216.32.60.167
n6g.akamaitech.NET.     16m11s IN A     216.32.60.167
n0g.akamaitech.NET.     16m11s IN A     192.215.32.118
n1g.akamaitech.NET.     31m11s IN A     192.215.32.119
n7g.akamaitech.NET.     31m11s IN A     216.32.172.39

@UW2 (same machine at a different time)
n3g.akamaitech.NET.     21m28s IN A     199.239.1.133
n4g.akamaitech.NET.     21m28s IN A     199.239.1.133
n6g.akamaitech.NET.     21m28s IN A     199.239.1.133
n5g.akamaitech.NET.     21m28s IN A     216.52.232.129
n0g.akamaitech.NET.     21m28s IN A     216.52.232.129
n7g.akamaitech.NET.     36m28s IN A     204.137.152.17
n1g.akamaitech.NET.     36m28s IN A     216.52.232.130
n2g.akamaitech.NET.     21m28s IN A     199.239.1.133
n8g.akamaitech.NET.     21m28s IN A     199.239.1.133

This has another nice (for Akamai load balancing), or not so nice (for things like organization wide caches) side effect. Different machines could be downloading the same object from different Akamai servers at the same time, if  those machines connect to different primary name servers within in the department (like our setup at UW-CSE).

Step 3

In the final step you go to one of the n[09]g.akamaitech.net name server and get the IP address of the machine you are looking for (e.g.:  a388.g.akamaitech.net). The server will return two IP addresses for each machine name. For instance, see the partial dig output below

a1388.g.akamaitech.net.  20S IN A  216.52.232.134
a1388.g.akamaitech.net.  20S IN A  216.52.232.149

Observe that the lifetime of this information is a mere 20 seconds (which corresponds to one or two web pages viewed) . So after this time period you will go back to the Akamai name server to get the IP addresses.  What this means is that even if both the machines go down, it is highly unlikely that this will be seen by the client.  (assuming that the Akamai name servers find this out and return a different IP in a failure scenario).

It is likely that all the machines don't host the content of all the customers. Suppose that there are three servers (three different machines) - A,B and C at a particular site (a site will typically have multiple machines). And the customers are X, Y and Z. So A will host X,Y, B will host Y,Z and C will host Z,X. This kind of an arrangement has a two-fold advantage
1) No server has to host all the customers' content. Easing the load on it and also making the content serving faster.
2) If any one server goes down, no customer is fully disconnected as there is another server (potentially more) with its tree.

A customer's content could be present at more than two servers at a site, but it makes sense to return the same two machines (till they are up) because of file caching, the object does not have to retrieved from the disk most of the times.

Another observed feature is that all the name servers in the set (n[0-9]g.akamaitech.net) returned in above step, give the same two IP addresses for a queried server (like a1388.g.akamaitech.net). This could mean that the configuration of all the servers in a set is identical and multiple servers are there just for sharing the load.

 

---

Akamai caches (courtesy Neal Cardwell )
The akamai machines at the edge are PCs running Linux and a slightly modified version of the squid cache. They are doing on-demand caching rather than push-based replication. Name server differences
An artifact of the above exploration is the observation that different versions of named  might be running in the department (@UW-CSE).
While 128.95.4.1 (bs4) always returns the two IP addresses in different order (to get some sort of load balancing), 128.95.1.6 (bs1) does no such thing.
And the one at MIT (18.26.0.36) seems to be returning the IP addresses in a random order.

 

 

The Akamai Drupal modules provides an integration with the Akamai Cache Control Utility (CCU) Web Service. This enables the purge/invalidation of cached URLs in the Akamai Global Network in response to different site events. It purges not only the canonical url for your page/node (node/123) but also any associated URL aliases.

The various mechanisms to clear Akamai cache are:

• Through an admin screen, allowing the specification of any number of URLs to clear manually.
• Through a block that can be put on your site to allow any specific page you are viewing to be cleared from the Akamai cache with a button click.
• Automatically responds to node updates and pushes cache clears for the node and any aliases.

This module also integrates with Context HTTP Headers to allow the specification of Akamai specific HTTP Response Headers to be set on any site page in reaction to a Context condition.

Credits

The development of this module was done as part of the Whitehouse.gov project and was sponsored by The Executive Office of the President.