0

I stumbled upon a YT video which explains that there's technically no limit to the number of connections that can be opened between the clients and servers even if there's a reverse proxy between them. I see that at max 64k connections can be opened b/w the reverse proxy and one of the backend server(assuming that the backend server listens on a single port for now).

The video mentions that 64k is the limit for L4 proxy and that's why L4 proxy is not scalable. What does "not-scalable" mean here? It also mentions that we cannot reuse the same TCP connection for anything else, why so? After the inception of HTTP/2.0 we can use the same TCP connection to send all kinds of HTTP requests so why can't the L4 proxy just do the same? Why can't it forward all the traffic that it has to send to a given backend server through one single TCP connection, it just has to replace the older TCP and IP header with the new header(with new sourceIP as itself and new destinationIP as one of the backend, similarly replace the ports as well). It doesn't have to seek into the HTTP frames for anything at all. Let me know if I'm incorrect in my understanding. Also, why is L4 connection to the backend called as "stateful"?

AFAIK, a L7 proxy just gets to the HTTP frames and extracts the request body and finds which exact backend to forward request to. What extra intelligence does it have to use the same TCP connection to forward all kinds of requests that an L4 proxy doesn't have?

The only difference that I see b/w L4 and L7 is that L4 doesn't get into the detail of what is inside the HTTP request while L7 is aware of that.

1 Answer 1

1

No one here's going to watch and explain some video for you. You need to make sure that all relevant information is in your question.

From what I can gather:

Not scalable means that you cannot scale your setup beyond a certain point, no matter what kind of hardware or software you throw at it.

A transport-layer proxy (L4) has only a single destination it can be pointed to - there's no way to tell it where else to go. Accordingly, each IP:port combination on the proxy can only forward to a single destination (not all L4 protocols use ports though). Between the proxy and its destination, there's a maximum of 216 connections (per private proxy IP address) as you can only use the proxy-side port to distinguish between connections.

On the application layer (L7), there may be information to control the outgoing connection - especially for HTTP there is the host header. Other L7 protocols may have similar headers or protocol stages or none at all.

Apart from that, applications and protocols above the transport layer are explicitly off-topic here, see the help center.

A TCP connection is (must be) stateful as that's how TCP works - a connection must be established before it can be used. In contrast, UDP is stateless and has no concept of a connection.

1
  • 1
    The 'stateful' part of the question is a key factor in 'why only 64k connections'. The connections must be maintained for some configured duration in order to be 'stateful' therefor they must be limited by the total number of 'stateful' connections that can be created. Each IP has a max number of ports available for creating stateful connection pairings, hence the limit. In other words, it is limited to that number because that is the maximum number of resources (ports per IP address) that are available because it was designed that way. May 31 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.