How we fine-tuned HAProxy to achieve 2M concurrent SSL connections (2017) • Hacker News Board

Re: How we fine-tuned HAProxy to achieve 2M concurrent SSL connections (2017)

#11

Post by toredash » Sat, Jan 12, 2019, 6:12 AM UTC

zokier wrote: post #6

chmod775 wrote: post #3

Earlier quoted context omitted.

There are at most 65536 ports per remote IP . TCP connections are basically identified with an (ip, port) tuple. Also you can set the file descriptor limits to whatever you want.

Aren't TCP connections more accurately identified by (srcip, srcport, dstip, dstport) tuple? This is somewhat significant as you can easily have tons of IPs in a single box.

Correct

Re: How we fine-tuned HAProxy to achieve 2M concurrent SSL connections (2017)

#12

Post by guiambros » Sat, Jan 12, 2019, 6:16 AM UTC

zokier wrote: post #6

chmod775 wrote: post #3

Earlier quoted context omitted.

There are at most 65536 ports per remote IP . TCP connections are basically identified with an (ip, port) tuple. Also you can set the file descriptor limits to whatever you want.

Aren't TCP connections more accurately identified by (srcip, srcport, dstip, dstport) tuple? This is somewhat significant as you can easily have tons of IPs in a single box.

Yes, but after the initial syn/ack, the daemon will allocate an outgoing port number for the connection. So if you have a single IP address and a burst with hundred of thousands of requests, you will run into problems..

Re: How we fine-tuned HAProxy to achieve 2M concurrent SSL connections (2017)

#13

Post by chmod775 » Sat, Jan 12, 2019, 9:34 AM UTC

zokier wrote: post #6

chmod775 wrote: post #3

Earlier quoted context omitted.

There are at most 65536 ports per remote IP . TCP connections are basically identified with an (ip, port) tuple. Also you can set the file descriptor limits to whatever you want.

Aren't TCP connections more accurately identified by (srcip, srcport, dstip, dstport) tuple? This is somewhat significant as you can easily have tons of IPs in a single box.

Yes, but local port and IP are usually fixed when running a HTTP server (unless you're binding to multiple IPs on one machine).

Re: How we fine-tuned HAProxy to achieve 2M concurrent SSL connections (2017)

#14

Post by ldng » Sat, Jan 12, 2019, 8:33 PM UTC

muststopmyths wrote: post #8

One quibble I would make with the article is that you are not actually limited to ~65k connections from a client. It is only ~65k per IP address on the client (given that they're all talking to a single remote port) You can add NICs or virtual IPs and bind your client instances to specific IP addresses instead of INADDR_ANY.

It is addressed in the previous article of the serie.