[lkml]   [1998]   [Jan]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: Masquerade: Any large network limits?
Date said:
} Major question is how many connections can linux masq "reliably"
} ie: 1000 connects? what about 5000?

There is a limit of 4096 simultaneous connections for each of TCP/UDP in
the 2.0.x series kernels. This can be tweaked - see ip_masq.h - at the
cost of memory.

Kernels pre 2.0.31 exhibited very poor new connection performance when
most of the masq slots were used - some connections could even be refused.
The newest version are better, but not brilliant.

Each connection has a timeout associated with it. The connections are not
torn down until the timeout has expired (although it is reduced at TCP
FIN, and set to near zero on TCP RST). This means that lots of short
connections (ie www connections) load much more heavily than long lived
connections since you are waiting for old ones to die. You could tweak
the timeouts to cope with this.

Our experience has seen the worst examples happen when systems behind the
masq box are doing direct DNS lookups through the box. This leaves lots
of UDP tunnels in place which take a few minutes to timeout.

The best solution is to make efficient use of your resources. Add a
caching name server to the masq box and everything else can look up off
that. Put a squid cache on the box and have www access through that. Use
masq for things that cannot be handled by an application (or transparent
application) proxy.

As ever adding memory helps more than adding CPU. Especially if you also
have named and squid on there.

[ - Systems Software Engineer ]
[ Tel : +44 113 251 6012 Fax : +44 113 234 6065 ]
[ Real life is but a pale imitation of a Dilbert strip ]

 \ /
  Last update: 2005-03-22 13:40    [W:0.032 / U:8.016 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site