[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fz_MKfy2CYKE_4NHlmOJzScM5AWtXcNtMfux-83XCCok":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"ff63b17f-5ee2-4698-bc67-3d55ecca76e3","article","Anycast：同一个 IP 地址，为什么可以同时存在于全球多座城市？","anycast-distributed-service-address","Anycast 让多个网络位置同时宣告同一个服务地址，由路由选择相对合适的节点，适合就近访问、故障吸收和攻击分散。","Anycast 的奇妙之处是：很多地理位置不同的服务器，可以同时宣告同一个服务地址。客户端只看到一个 IP，但路由系统会根据网络路径把请求送到某个“相对合适”的节点。这让地址本身成为一张分布式服务入口。\n\n可以把它想成同一个连锁急救号码在多座城市都有值班中心。拨号时不需要知道具体哪一座中心接听，网络会把呼叫导向路径更近、可达性更好的地点。DNS 根服务器、公共递归解析器、内容分发和抗攻击服务经常利用类似思路，把同一服务部署到多个网络位置。\n\nAnycast 通常依赖 BGP 等路由协议，由不同站点发布相同前缀。路由选择并不一定等于物理距离最近，而是由策略、路径长度、运营商关系和故障情况共同决定。一个节点撤回路由后，流量可以逐步转向其他节点，因而具备一定的故障吸收能力。\n\n它对无状态或短请求尤其友好。长连接、会话状态和事务如果在中途被路由到另一节点，就需要共享状态、连接迁移或会话粘性，否则用户可能遇到中断。网络变化还可能让同一客户端在一段时间内到达不同节点，监控与排障必须把路由视角纳入考虑。\n\n因此 Anycast 不是“一个 IP 自动复制服务器”，而是一种用路由层表达服务可用位置的架构。它把就近访问、故障转移和攻击分散结合起来，同时把状态同步、路径不稳定和流量可观测性带来的复杂度交给运营系统处理。\n\n部署 Anycast 时，监控不能只做一次 TCP 连通性探测，而要从多个网络位置持续观察路由、节点命中分布、连接失败和会话迁移。一个站点即使本地健康，也可能因为错误宣告前缀吸走过多流量；撤路由、限流和健康检查必须与发布流程联动。\n\nAnycast 也会改变“服务器在哪里”的排障习惯。同一个客户端在不同时间可能命中不同站点，因此日志必须带上站点、路由入口和请求标识；否则单看一个中心化服务端的错误率，很难解释为什么只有某些地区或某些运营商受影响。\n\n资料来源：[RFC 4786：Operational Recommendations for Anycast Services](https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc4786)","\u002Fuploads\u002F2026-09-26\u002F4d0f5f62-b792-46d5-88c3-72f4648c3cb0.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"RFC 4786：Operational Recommendations for Anycast Services","https:\u002F\u002Fwww.rfc-editor.org\u002Finfo\u002Frfc4786","published",false,54,0,"2026-09-27T00:00:00.000Z","2026-09-26T16:26:24.781Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":70,"createdAt":71},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:55.563Z"]