Squid Proxy – Maximum Number of Connections on Linux

connectionlinuxsquid

What is the maximum number of connections squid can support at a time? There are 5000 users in a campus so how many squid proxy systems will I need?

Best Answer

It depends on the nature of the connections, the speed of the networks between the proxy and server / proxy and client. Knowing that there are 5000 users doesn't give a lot of information about the number of concurrent connections. But presumably these people are able to access the internet currently - so why not measure the what they are doing now?

Certainly for this volume it would be reasonable to provide more than one proxy in terms of reliability, and since licensing costs should not be an issue, then I'd recommend using more low-spec machines over fewer high-spec ones. I suspect that 2-3 very low end boxes (Athlon X2, 2-4Gb memory) but with extra HD capacity (say 2x500Gb disks as a mirrored array) would suffice. They'd also benefit from having a faster interconnect independent of the internet and intranet connections - so at least 3 NICs. Once you've worked out how to the load balancing, adding more nodes (if you need them) is trivial.

Related Solutions

Linux Server Performance – What Limits Maximum Number of Connections?

I finally found the setting that was really limiting the number of connections: net.ipv4.netfilter.ip_conntrack_max. This was set to 11,776 and whatever I set it to is the number of requests I can serve in my test before having to wait tcp_fin_timeout seconds for more connections to become available. The conntrack table is what the kernel uses to track the state of connections so once it's full, the kernel starts dropping packets and printing this in the log:

Jun  2 20:39:14 XXXX-XXX kernel: ip_conntrack: table full, dropping packet.

The next step was getting the kernel to recycle all those connections in the TIME_WAIT state rather than dropping packets. I could get that to happen either by turning on tcp_tw_recycle or increasing ip_conntrack_max to be larger than the number of local ports made available for connections by ip_local_port_range. I guess once the kernel is out of local ports it starts recycling connections. This uses more memory tracking connections but it seems like the better solution than turning on tcp_tw_recycle since the docs imply that that is dangerous.

With this configuration I can run ab all day and never run out of connections:

net.ipv4.netfilter.ip_conntrack_max = 32768
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_tw_reuse = 0
net.ipv4.tcp_orphan_retries = 1
net.ipv4.tcp_fin_timeout = 25
net.ipv4.tcp_max_orphans = 8192
net.ipv4.ip_local_port_range = 32768    61000

The tcp_max_orphans setting didn't have any effect on my tests and I don't know why. I would think it would close the connections in TIME_WAIT state once there were 8192 of them but it doesn't do that for me.

Maximum number of connections Squid

This wont solve the problem the way you purpose. But in a different way, limiting each host to a certain bandwith (not per request, but per host)

example taken from http://wiki.squid-cache.org/Features/DelayPools

acl only128kusers src 192.168.1.0/24
delay_pools 1
delay_class 1 3
delay_access 1 allow only128kusers
delay_access 1 deny all
delay_parameters 1 64000/64000 -1/-1 16000/64000

this specify that all clients have 512kbits to share but a single ip can only use 128kbits.

note that the values for delay_parameters above are in BYTES and not BITS.

Best Answer

Related Solutions

Linux Server Performance – What Limits Maximum Number of Connections?

Maximum number of connections Squid

Related Topic