Post mortem of a failed HackerNews launch

Re:Post mortem of a failed HackerNews launch by zorlem on Thursday November 29, 2012 @11:49AM (#4848656)

> 3. Use IPTABLES xt_connlimit to make sure people aren't abusing connections, even by accident - no client should have more than 20 connections to port 80, maybe even as low as 5 if your server is under a "friendly" ddos. If you are reverse proxying to apache, connlimit is a MUST.

One must be careful when setting connection limits like this. A lot of people still use proxy servers and with modern browsers it quite easy to hit 20 concurrent connections per IP address.

[ Parent | on HN ]

Re:Post mortem of a failed HackerNews launch by ck2 on Thursday November 29, 2012 @11:54AM (#4848687)

The connlimit only affects simultaneous connections, and they all should be handled relatively quickly.

It's important to understand connlimit will cause people to queue, not to get blocked, and if 20 people are connecting all at the very exact millisecond from the same ip, well it cannot hurt to queue them for server stability.

[ Parent | on HN ]

Re:Post mortem of a failed HackerNews launch by zorlem on Thursday November 29, 2012 @12:18PM (#4848839)

I agree that having a simultaneous connection limit is a good safeguard. I was just noting that simply limiting the simultaneous connections to eg. 20, without considering all side-effects could lead to a world of hard-to-diagnose-and-reproduce problems and frustrated customers.

HTTP Keep-alive connections play a big role in the number of connections as well so this should be considered when choosing the number.

[ Parent | on HN ]