[lkml]   [1998]   [Jan]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Masquerade: Any large network limits?
    Date said:
    } Major question is how many connections can linux masq "reliably"
    } ie: 1000 connects? what about 5000?

    There is a limit of 4096 simultaneous connections for each of TCP/UDP in
    the 2.0.x series kernels. This can be tweaked - see ip_masq.h - at the
    cost of memory.

    Kernels pre 2.0.31 exhibited very poor new connection performance when
    most of the masq slots were used - some connections could even be refused.
    The newest version are better, but not brilliant.

    Each connection has a timeout associated with it. The connections are not
    torn down until the timeout has expired (although it is reduced at TCP
    FIN, and set to near zero on TCP RST). This means that lots of short
    connections (ie www connections) load much more heavily than long lived
    connections since you are waiting for old ones to die. You could tweak
    the timeouts to cope with this.

    Our experience has seen the worst examples happen when systems behind the
    masq box are doing direct DNS lookups through the box. This leaves lots
    of UDP tunnels in place which take a few minutes to timeout.

    The best solution is to make efficient use of your resources. Add a
    caching name server to the masq box and everything else can look up off
    that. Put a squid cache on the box and have www access through that. Use
    masq for things that cannot be handled by an application (or transparent
    application) proxy.

    As ever adding memory helps more than adding CPU. Especially if you also
    have named and squid on there.

    [ - Systems Software Engineer ]
    [ Tel : +44 113 251 6012 Fax : +44 113 234 6065 ]
    [ Real life is but a pale imitation of a Dilbert strip ]

     \ /
      Last update: 2005-03-22 13:40    [W:0.018 / U:68.564 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site