[ https://issues.apache.org/jira/browse/TS-1075?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13288015#comment-13288015 ]
Danny Shporer commented on TS-1075: ----------------------------------- I have been thinking this over and you are right. Since the source/dest order of the packets is always ingress or egress and never both (this is the fact I was skipping), the kernel can properly identify the packets. Thank you for the clarification. I agree the the NAT firewall is a non-issue since that in itself is a bottleneck on the port range. The only minor issue to mention is trouble-shooting - when sniffing the NIC and seeing the 2 identical streams (accept maybe some layer 7 changes which ATS may have done - depending on the implementation) that could get confusing. But that's definitly something we can live with. Cheers > Port range bottleneck in transparent proxy mode > ----------------------------------------------- > > Key: TS-1075 > URL: https://issues.apache.org/jira/browse/TS-1075 > Project: Traffic Server > Issue Type: Bug > Components: Core > Affects Versions: 3.0.1 > Environment: Centos 5.6, kernel 2.6.39.2 compiled with TPROXY support > ATS compiled as: ./configure --enable-tproxy > Reporter: Danny Shporer > Assignee: B Wyatt > Fix For: 3.1.4 > > Attachments: ports.patch > > > The Linux TPROXY stack only takes into account the local addresses when using > dynamic bind (bind without specifying a specific port). This limits the port > range to only the local range (around 30K by default and can be extended to > around 64K) - this together with the TIME-WAIT Linux method of releasing > ports causes a bottleneck). > One symptom of this is that traffic_cop cannot open a connection to the > server to monitor it (it gets error 99 - address already in use) and kills > it. > Another issue is when opening the connection to the server. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa For more information on JIRA, see: http://www.atlassian.com/software/jira