[squid-users] Scaling concurrent TCP sessions beyond ephemeral port range

[Praveen Ponakanti]

Hi,

We have patched in a small code diff to add the IP_BIND_ADDRESS_NO_PORT
sockopt flag and it has been working fine as we can see outbound TCP ports
being reused with different destination IP addresses.

Have some followup questions.
A lot of the client requests in our setup go to a small set of destination
webservers ( < 10), so we still run the risk of running out of ports for
concurrent connections to a single destination webserver. We have not
enabled the squid for caching and run multiple instances each with 30
workers.
- Is there some config knob available to have squid efficiently reuse
outbound connections across multiple client requests? It appears that each
client's request creates a separate TCP connection to the dest webserver
even if they are the same. This happens for both HTTP and HTTPS. How do we
enable connection pooling if that is available with squid?
- If this is something that isn't supported with v5.5, do you
recommend investigating code modifications to allow the reuse of outbound
connections? Any suggestions or gotchas before we go about this approach?

We have looked into the multiple tcp_oubound_adress option but would prefer
not to go that route.

Thanks
Praveen


On Fri, May 20, 2022 at 9:31 PM Amos Jeffries <squid3 at treenet.co.nz> wrote:

> On 20/05/22 19:44, Praveen Ponakanti wrote:
> > Hi Alex,
> >
> > Thanks for going through several steps to help mitigate src port
> > exhaustion. We are looking to achieve 400-500% more
> > concurrent connections if we could :) as there is a significant buffer
> > on the available CPU.
>
> Then you require at least 4, maybe 5, IP addresses to handle that many
> concurrent connections with Squid.
>
>
> > The option to use multiple tcp_outoing_addresses appears to be promising
> > along with some tweaks to the TCP timeouts. I guess we could use ACLs to
> > pick a different outbound IP based on the requesting client's prefix. We
> > had not considered that option as the ephemeral ports were no longer
> > available to other applications when squid uses most of them with a
> > single outbound IP configured. We are also looking to modify the code to
> > use the IP_BIND_ADDRESS_NO_PORT sockopt as that could help delay port
> > assignment with the bind() call on the outbound TCP sessions (to
> > hopefully allow access to the 4-tuple on the socket).
>
> Patches welcome.
>
> However, please be aware that use of the 4-tuple is often no different
> from the 3-tuple since the dst-port is typically identical for all
> outgoing traffic to a given dst-IP.
>
>
> Cheers
> Amos
> _______________________________________________
> squid-users mailing list
> squid-users at lists.squid-cache.org
> http://lists.squid-cache.org/listinfo/squid-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20220601/af8988c8/attachment.htm>