Patent ID: 8015298

Claim:
A method, operable in a load-balancing cluster comprising: (i) a switch having a plurality of ports; and (ii) a cluster of servers comprising a plurality of servers connected to at least some of the plurality of ports of the switch, each of said servers being addressable by the same virtual Internet Protocol (VIP) address, and each of the servers having a unique hardware address, the method comprising: (A) obtaining at the switch a connection request to connect a client computer to a server associated with said VIP address; (B) providing, via the switch, said connection request to each server connected to the switch; (C) at least one of said servers determining which server of said cluster of servers is to handle the connection, wherein the determining is based, at least in part, on a given function of information used to request the connection, whereby a first server of the cluster of servers is determined to handle the connection; (D) said first server establishing the connection with the client computer as a Transmission Control Protocol (TCP) connection and updating a firewall of the first server to allow incoming traffic at the first server related to said connection; (E) other servers of the cluster of servers updating a corresponding firewall of each of said other servers to reject incoming traffic related to the TCP connection between the client computer and the first server; (F) having established the TCP connection with the client computer, the first server: (f1) obtaining a request from the client computer for a resource; (f2) determining whether or not to attempt to handoff the TCP connection with the client computer to a second server of the cluster of servers, the determining in (f2) being based, at least in part, on whether the second server had already handled a previous connection request from the client computer; and (f3) based on the determining in (f2), attempting to handoff the TCP connection with the client computer to the second server when said determining in (f2) determines the second server had already handled a previous connection request from the client computer, the handoff being transparent to the client computer.