4 ms·

Could you explain or post a link to something about #2? I’ve never heard of that before!

by dylanz 7y ago

thecopy 7y ago
I would also be interested in this. First time I hear about such a limitation.
sciurus 7y ago
I can not. AWS, for whatever reason, does not want this publicly documented. I would write up what we learned in our testing in more detail, but I have been asked not to. You can find some discussion of this behavior in places like https://forums.aws.amazon.com/thread.jspa?threadID=231806 https://forums.aws.amazon.com/thread.jspa?threadID=231806. I originally became aware of the issue, before hitting in production, from the HN comment at https://news.ycombinator.com/item?id=18314138 https://news.ycombinator.com/item?id=18314138
- toast0 7y ago
  I'm glad you found my comment helpful! I myself found out about to avoid the connection tracking in this thread https://news.ycombinator.com/item?id=15724072 https://news.ycombinator.com/item?id=15724072 It's super frustrating that Amazon doesn't document this in a more approachable manner.
- QuinnyPig 7y ago
  Their response displeases me.
runT1ME 7y ago
I can corroborate this, at Verizon we had problems scaling out ELBs for a very similar use case.
toredash 7y ago
This is what you need to know: "Not all flows of traffic are tracked. If a security group rule permits TCP or UDP flows for all traffic (0.0.0.0/0) and there is a corresponding rule in the other direction that permits all response traffic (0.0.0.0/0) for all ports (0-65535), then that flow of traffic is not tracked. The response traffic is therefore allowed to flow based on the inbound or outbound rule that permits the response traffic, and not on tracking information."
- chatmasta 7y ago
  Very interesting. It makes a lot of sense from a Linux perspective. The conntrack table requires memory, so there is some physical limit on its size. That also explains why it scales per instance type.
  - toredash 7y ago
    This is also why "endless scaling" is a fud. At some point or some level, there is either a physical, soft, standard or some kind of limit

Could you explain or post a link to something about #2? I’ve never heard of that before!

by dylanz 7y ago

Could you explain or post a link to something about #2? I’ve never heard of that before!

thecopy 7y ago

I would also be interested in this. First time I hear about such a limitation.

sciurus 7y ago

I can not. AWS, for whatever reason, does not want this publicly documented. I would write up what we learned in our testing in more detail, but I have been asked not to. You can find some discussion of this behavior in places like https://forums.aws.amazon.com/thread.jspa?threadID=231806 https://forums.aws.amazon.com/thread.jspa?threadID=231806. I originally became aware of the issue, before hitting in production, from the HN comment at https://news.ycombinator.com/item?id=18314138 https://news.ycombinator.com/item?id=18314138

toast0 7y ago
I'm glad you found my comment helpful! I myself found out about to avoid the connection tracking in this thread https://news.ycombinator.com/item?id=15724072 https://news.ycombinator.com/item?id=15724072 It's super frustrating that Amazon doesn't document this in a more approachable manner.
QuinnyPig 7y ago
Their response displeases me.

runT1ME 7y ago

I can corroborate this, at Verizon we had problems scaling out ELBs for a very similar use case.

toredash 7y ago

This is what you need to know: "Not all flows of traffic are tracked. If a security group rule permits TCP or UDP flows for all traffic (0.0.0.0/0) and there is a corresponding rule in the other direction that permits all response traffic (0.0.0.0/0) for all ports (0-65535), then that flow of traffic is not tracked. The response traffic is therefore allowed to flow based on the inbound or outbound rule that permits the response traffic, and not on tracking information."

chatmasta 7y ago
Very interesting. It makes a lot of sense from a Linux perspective. The conntrack table requires memory, so there is some physical limit on its size. That also explains why it scales per instance type.
- toredash 7y ago
  This is also why "endless scaling" is a fud. At some point or some level, there is either a physical, soft, standard or some kind of limit