Forum Discussion

Paolo_125657's avatar
Paolo_125657
Icon for Nimbostratus rankNimbostratus
Dec 26, 2014

SSL TPS

Hi I'm in the middle of sizing a new pair of LB and tinkling about upgrading pairs in other DC after having decided to go https for a website.

 

Now i have 2 pairs of 6900 one pair of 5200 and one of 4200 , the TPS are slightly different here we go form 500 of the 6900 to the 20k of the 5200.

 

Fact is i do not really understand how to figure out what it is going to happen if i turn on https for the website:

 

here few numbers:

 

Max sessions on the http vip reached 64k Max new sessions per second form other stats sources reached 600 Just simply browsing the site with a loop on netstat i see sessions open each second going form 4 to 8 depending on the page I'm browsing.

 

I have been reading of session identifier and ssl ticketing etc...

 

Question is what TPS is:

 

60k ( number of max concurrent https connections) 600 (new web session per second) 600 x 8 (new web s/s multiplied by the max number of connections to my website) of maybe 60k divided by 8 ?

 

Thanks Paolo

 

application delivery
availability
design
management
performance
TMSH

9 Replies

Sort By
  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 26, 2014

    TPS for ssl/tls are based on new connections. The licensed value is 1/100th of the advertised figure in a 10ms timeslot.

     

    So if youre planning on 60k connections per second youll need to do something clever like offloading the ssl to separate devices... Is that figure (60k ) because you're perhaps not doing http keepalives?

     

  • Brad_Parker's avatar
    Brad_Parker
    Icon for Cirrus rankCirrus
    Dec 26, 2014

    I would think your 600 new sessions/server a second would be closer to what TPS numbers would be. 600*8 would be 4800. TPS is the number of new SSL sessions, so that number may even be less than 4800. As I look at our gear right now, I see ~32k+ connections and spikes up to 600 TPS. Its a slow day...

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 28, 2014

    Sorry, but TPS is done on connections. Has been since v9. IIRC v4.5 and earlier used to make that distinction... It caught us by surprise after the upgrade too...

     

    Sessions are almost irrelevant (For license). Except that the number does affect the SSL session cache size... You need to know the number of CONNECTIONS per second to work out your TPS requirements (Which is why http keep-alives make so much of a difference)

     

    Hint: The required license value will normally be around 2x the peak number of SUSTAINED connections per second averaged over a 60 second period. i.e. if you see 10k connections per second averaged over 60 seconds (i.e. 600k connections in a minute), you'll need an SSL license of around 20k. [That assumes it's the kind of site that does reasonably steady traffic. Not one subject to massive sudden peaks]

     

    H

     

  • Paolo_125657's avatar
    Paolo_125657
    Icon for Nimbostratus rankNimbostratus
    Dec 29, 2014

    So merging it all up if i read all the above correctly:

     

    I do have 600 new web session per second which generate an average of 8 connections per second i do need to size TPS at 4800.

     

    Btw we do use keep alives.

     

    Cheers

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 29, 2014

    Where did you get 8 connections per second from? Just watching netstat? That's not going to be accurate.

     

    SSL TPS is connections per second... if you have 8 connections/second, it's 8 TPS...

     

    However I very much doubt you get 600 new sessions/second from just 8 connections... Hence doubly^lots doubt your netstat conclusions above...

     

    H

     

  • Paolo_125657's avatar
    Paolo_125657
    Icon for Nimbostratus rankNimbostratus
    Dec 29, 2014

    Hi obliviously not - it's just a guess looking at the behavior of our homepage, I have 600 new WEB sessions per second, each web session usually implies 8 http connections, which without considering reuse of ssl handshakes like session identifier and ssl ticketing etc... would bring the number up to 600 x 8 = 4800 TPS.

     

    I thought that makes sense. Would would make sense for you ?

     

    Paolo

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 29, 2014

    Rather than guessing, what would make sense to be is looking at the number of connections per second of the http VS (the one you want to move to https). You have the traffic already. No guesses required really...

     

    4800 would be a reasonable assumption if each session lasts for a second and all 8 connections complete in that second... Those assumptions might not hold up...

     

    H

     

  • Paolo_125657's avatar
    Paolo_125657
    Icon for Nimbostratus rankNimbostratus
    Dec 29, 2014

    Just wanted to avoid enable analytic - that's the reason why. Http connections last very long indeed at every given time I have at least 45k connections to the VIP, maxing at 60 - 70k depending on the day.

     

    I think the 4800 makes enough sense.

     

    P

     

  • Hamish's avatar
    Hamish
    Icon for Cirrocumulus rankCirrocumulus
    Dec 29, 2014

    You dont need analytics. Just have a look at the total number of connections every 60 seconds... Take the diff between two readings (over peak time). Divide by 60. Double that will be the ssl license you need.

     

    You can use cacti, script it or do by hand.

     

    Without evidence 4800 makes as much sense as any other number... Might be right. Might not. Method above will tell you for sure.

     

    H