Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
•
YouTube Security VideosNeil Patel: The 3-Search Test For Your Business #shorts(24.09.2026 um 20:04 Uhr)
•
YouTube Security VideosLinus Tech Tips: The One Apple Product I Fanboy Over(24.09.2026 um 20:18 Uhr)
•
YouTube Security VideosMicrosoft Mechanics: One Prompt Builds Your Copilot Agent(24.09.2026 um 20:15 Uhr)
••
Sichere ProgrammierungAI-powered fuzzing with the GitHub Security Lab Taskflow Agent(24.09.2026 um 20:26 Uhr)
•••
Sichere ProgrammierungBuilt an Agentic Fraud Investigator using(24.09.2026 um 20:15 Uhr)
•
Sichere ProgrammierungBuilding a fraud investigator that argues with itself(24.09.2026 um 20:15 Uhr)
••
YouTube Security VideosNeil Patel: The 3-Search Test For Your Business #shorts(24.09.2026 um 20:04 Uhr)
•
YouTube Security VideosLinus Tech Tips: The One Apple Product I Fanboy Over(24.09.2026 um 20:18 Uhr)
•
YouTube Security VideosMicrosoft Mechanics: One Prompt Builds Your Copilot Agent(24.09.2026 um 20:15 Uhr)
••
Sichere ProgrammierungAI-powered fuzzing with the GitHub Security Lab Taskflow Agent(24.09.2026 um 20:26 Uhr)
•••
Sichere ProgrammierungBuilt an Agentic Fraud Investigator using(24.09.2026 um 20:15 Uhr)
•
Sichere ProgrammierungBuilding a fraud investigator that argues with itself(24.09.2026 um 20:15 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

Stop Using Round-Robin: High-Throughput Java Virtual Thread Routing with P2C

Stop Using Round-Robin: High-Throughput Java Virtual Thread Routing with P2C Virtual threads allow Java microservices to comfortably run 50,000 concurrent requests per instance, but your legacy round-robin load balancer is utterly…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




Stop Using Round-Robin: High-Throughput Java Virtual Thread Routing with P2C



Virtual threads allow Java microservices to comfortably run 50,000 concurrent requests per instance, but your legacy round-robin load balancer is utterly destroying your p99 latency. Blindly distributing traffic without accounting for dynamic queue depth creates catastrophic head-of-line blocking across Loom-enabled nodes.






Why Most Developers Get This Wrong





  • Assuming uniform execution speed: Round-robin assumes every request takes equal time, which breaks down the moment heavy virtual thread workloads hit asymmetric I/O bottlenecks.


  • Using raw CPU/Memory metrics for routing: Host-level metrics update every few seconds, making them completely blind to microsecond-level virtual thread queue spikes.


  • Falling into the "least-connections" herd effect: Naive least-connections algorithms target newly recovered instances simultaneously, flooding them with traffic until they instantly collapse under thread contention.






The Right Way



Use Power-of-Two-Choices (P2C) coupled with Exponentially Weighted Moving Average (EWMA) to make high-throughput, $O(1)$ routing decisions.




  • Randomly sample exactly two instances from your service discovery pool using ThreadLocalRandom.

  • Compute a real-time health score for both: $\text{Score} = (\text{Active Virtual Threads} + 1) \times \text{EWMA Latency}$.

  • Route the current request to the node with the lower score, mitigating tail latencies without lock contention.

  • Decay latency historical data continuously using an exponential decay factor to ignore outdated network blips.




Want to go deeper? javalld.com — machine coding interview problems with working Java code and full execution traces.







Show Me The Code (or Example)






public class P2CLoadBalancer {
private final List<UpstreamNode> nodes;

public UpstreamNode select() {
int size = nodes.size();
if (size == 0) throw new IllegalStateException("No healthy nodes");
if (size == 1) return nodes.getFirst();

int i1 = ThreadLocalRandom.current().nextInt(size);
int i2 = (i1 + 1 + ThreadLocalRandom.current().nextInt(size - 1)) % size;

UpstreamNode n1 = nodes.get(i1);
UpstreamNode n2 = nodes.get(i2);

// Pick the node with lower (ActiveRequests * EWMA Latency)
return (n1.getEwmaScore() <= n2.getEwmaScore()) ? n1 : n2;
}
}









Key Takeaways




  • Round-robin is dead for high-concurrency Java architectures; virtual threads demand dynamic, latency-aware routing.

  • Power-of-Two-Choices (P2C) delivers near-optimal global load distribution while avoiding the heavy synchronization costs of full node scans.

  • Combine active request tracking with EWMA decay to keep your p99 and p999 tail latencies flat under bursty traffic.

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Vulnerability Remediation & Verification
title: Detect Exploitation - Stop Using Round-Robin: High-Throughput Java Virtual Thread Routing with P2C
id: ff468c0b-25df-457f-8059-ccfe772fea4d
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Stop Using Round-Robin: High-T" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Stop Using Round-Robin: High-Throughput .... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-57175 | Python Social Auth is a social authentication/registration mechanism. Pr…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel • Rechts: nächster Artikel • unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle