Hacker News Reader

1. Why can't the "ip_local_port_range" be changed? Wouldn't increasing the range help with short lived connections?

2. What is the maximum limit on active connection?

1. This is largely a restriction that comes from earlier versions. In earlier versions we relied on the source port to be in the range, as we remapped it in user space. Now, we let iptables / conntrack do it. We might go back to writing it with the conntrack entry though. There are some unfortunate awkward aspects of how iptables does free tulle mapping that can prove annoying.

2. This is a complicated question. You don't pay minuteman for active connections, only at connection construction time. You are reliant on netfilter's conntrack capabilities. By default these are built for 100s of thousands of connections. Given that in DC/OS this runs on every client, we are fairly confident in this approach, though conntrack could reasonably scale to millions of connections.

Reply on news.ycombinator.com