[Top] [All Lists]

Re: FWIW Connection Sharing Stats

2011-08-29 18:11:04

Murray S. Kucherawy wrote:

I don't think one can tell whether a particular client is connection caching by observing protocol activity in terms of time between commands/disconnect.

Who said that was the measurement? My log scanner is measuring the delays at each at the state machine.

I also don't think one can tell based on those same data whether any delays are caused by deliberate software action, CPU scheduling, network latency, or anything else.

Sure you can, when its persistent to the 100th of the microsecond. Maybe your logs are 1 second resolutions. Ours are not and was change precisely for measuring where time is spent across all points in the SMTP state machine. Facebook is persistently around 5.01 second and Google around 30.05. Same with others.

I might make that conclusion if I saw a client sending periodic RSET or NOOP commands, but I haven't seen any evidence of such.

But no one said they were using a KEEP-ALIVE concept. What I seen with RSET is that its either used or not, because it can start with MAIL FROM.

If someone thinks (for example) that Facebook might be connection caching and wants to find out for sure, one could always go and ask them.

That answers only their behavior, the general issue and concern. Even if we did ask them, the answer either way doesn't change the picture. It might suggest though that the they realize CS is not efficient and multi-threaded or multi-concurrent connections are better - why? For the same reason you think every system is capable of handling any load thrown at them.

I also have my doubts that the bad guys are implementing connection caching.

Yet, the evidence is showing some are delaying and others are not. That generalization is simply not realistic.

Data does not lie. Common sense and basic science doesn't either. If GOOGLE is using 30 seconds per QUIT with 99.99% of the time there is no multi-transaction within that time frame, its a waste and if a server pulled the rug to 5 seconds, there will be a tremendous amount of resources save - even for the largest.

This is starting to sound like a conversation the ASRG might enjoy rather than this forum.


PS: Today's stats shows an average of 1.5 secs QUIT which is a 50% reduction from the month average before lowering the QUIT idle time from 5 to 1 min. We have more idle timeouts and yet to see a connection throttle (which by the way, our license limit is 25 per sec, again, per sec, probably means nothing to you).


Hector Santos