How we fine-tuned HAProxy to achieve 2M concurrent SSL connections (2017)

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by billconan on Friday January 11, 2019 @12:02PM (#18884865)

I have a stupid question, there are at most 65536 ports and some are not usable. There is also a file descriptor limitation. How to have that many concurrent connections?

https://unix.stackexchange.com/questions/84227/limits-on-the...

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by chmod775 on Friday January 11, 2019 @12:06PM (#18884894)

There are at most 65536 ports per remote IP.

TCP connections are basically identified with an (ip, port) tuple.

Also you can set the file descriptor limits to whatever you want.

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by LinuxBender on Friday January 11, 2019 @01:19PM (#18885544)

To further clarify, even if you only had 1 host behind a proxy, you can create multiple listeners for that application on different ports or IP's. I do this for a few of my servers to avoid fin-wait / time-wait assassination attacks.

i.e. have apache listen on 127.0.0.* and set up ifcfg-lo-range with

    IPADDR_START=127.0.0.10
    IPADDR_END=127.0.0.99
    PREFIX=8
    CLONENUM_START=10

Or have the server behind haproxy listen on a few hundred ports.

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by zokier on Friday January 11, 2019 @03:04PM (#18886431)

Aren't TCP connections more accurately identified by (srcip, srcport, dstip, dstport) tuple? This is somewhat significant as you can easily have tons of IPs in a single box.

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by guiambros on Saturday January 12, 2019 @01:16AM (#18890005)

Yes, but after the initial syn/ack, the daemon will allocate an outgoing port number for the connection. So if you have a single IP address and a burst with hundred of thousands of requests, you will run into problems..

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by chmod775 on Saturday January 12, 2019 @04:34AM (#18890464)

Yes, but local port and IP are usually fixed when running a HTTP server (unless you're binding to multiple IPs on one machine).

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by toredash on Saturday January 12, 2019 @01:12AM (#18889985)

Correct

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by Florin_Andrei on Friday January 11, 2019 @02:44PM (#18886231)

> TCP connections are basically identified with an (ip, port) tuple.

I believe the full identifier is a quad: (source ip, source port, dest ip, dest port).

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by mrkstu on Friday January 11, 2019 @03:12PM (#18886495)

Also note that DNS will load balance the IP presented. For instance 'dig'ing yahoo.com gives me the following:

  ;; ANSWER SECTION:
  yahoo.com.		92	IN	A	72.30.35.9
  yahoo.com.		92	IN	A	98.138.219.231
  yahoo.com.		92	IN	A	72.30.35.10
  yahoo.com.		92	IN	A	98.137.246.7
  yahoo.com.		92	IN	A	98.138.219.232
  yahoo.com.		92	IN	A	98.137.246.8

So you can now multiple the quad by the number of public IPs you load up into your DNS record.

[ Parent | on HN ]

Re:How we fine-tuned HAProxy to achieve 2M concurrent SSL co... by dorfsmay on Friday January 11, 2019 @04:15PM (#18887102)

> Also you can set the file descriptor limits to whatever you want.

Isn't limited by the amount of memory?

[ Parent | on HN ]