Messages in this thread | | | From | Nigel Metheringham <> | Subject | Re: Masquerade: Any large network limits? | Date | Thu, 01 Jan 1998 16:46:27 +0000 |
| |
pmain@www.gc.cc.fl.us said: } Major question is how many connections can linux masq "reliably" } ie: 1000 connects? what about 5000?
There is a limit of 4096 simultaneous connections for each of TCP/UDP in the 2.0.x series kernels. This can be tweaked - see ip_masq.h - at the cost of memory.
Kernels pre 2.0.31 exhibited very poor new connection performance when most of the masq slots were used - some connections could even be refused. The newest version are better, but not brilliant.
Each connection has a timeout associated with it. The connections are not torn down until the timeout has expired (although it is reduced at TCP FIN, and set to near zero on TCP RST). This means that lots of short connections (ie www connections) load much more heavily than long lived connections since you are waiting for old ones to die. You could tweak the timeouts to cope with this.
Our experience has seen the worst examples happen when systems behind the masq box are doing direct DNS lookups through the box. This leaves lots of UDP tunnels in place which take a few minutes to timeout.
The best solution is to make efficient use of your resources. Add a caching name server to the masq box and everything else can look up off that. Put a squid cache on the box and have www access through that. Use masq for things that cannot be handled by an application (or transparent application) proxy.
As ever adding memory helps more than adding CPU. Especially if you also have named and squid on there.
Nigel. -- [ Nigel.Metheringham@theplanet.net - Systems Software Engineer ] [ Tel : +44 113 251 6012 Fax : +44 113 234 6065 ] [ Real life is but a pale imitation of a Dilbert strip ]
| |