Date: Tue, 19 Mar 2002 11:35:48 -0600 (CST) From: Mike Silbersack <silby@silby.com> To: freebsd-net@freebsd.org Subject: ephemeral port allocation - time for a change? Message-ID: <20020319111522.H49521-100000@patrocles.silby.com>
next in thread | raw e-mail | index | archive | help
By filing PR docs/32041, Mark Blackman has reminded me of an issue that has been nagging me for some time now. As Mark points out, one of the likely problems in the sysadmin mag benchmark run last spring was that the system ran out of ephemeral ports. Unforunately, nobody caught this at the time, and the benchmarkers were unable to explain why freebsd hit a connection limit below that of the other OSes. Right now, we're still using the traditional port range of 1024-5000, which limits us to a little under 4000 distinct outgoing connections. AFAIK, other OSes have started transitioning to the now preferred port range of 49152-65535, which would give us about 4x more breathing room. Looking through the logs for in.h, I can see that peter attempted changing the port range to 20000-30000 about 6 years ago, but reverted the change because of firewall issues. My question is this: Is anyone aware of a reason that using 49152-65535 by default would cause problems today? I quickly looked through netstat -n on freefall, and it appears that many systems are using those ports for ephemeral usage these days. If no problems will be caused, I'd like to go ahead and make the switch so that people running systems with large numbers of outbound connections are less likely to bump into the limit. <Part for Terry to comment on which should not turn into a distraction for the above.> One other issue relating to this is that ephermal ports are shared across all IPs, meaning that the ephemeral port limit is currently a hard limit on the number of outbound connections that may be made. If one were to rewrite the port allocation code so that the limit applied to each IP individually, many of the problems of running out of ephemeral ports would be mitigated. However, this is not an easy change, and doesn't negate all of the advantages of expanding the usable port range as mentioned above. (For example, even with such code we'd still hit a limit when establishing multiple connections to a single service on a single box, as is probably done when benchmarking.) </Part for ...> Thanks, Mike "Silby" Silbersack To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020319111522.H49521-100000>