Concurrent connection control is used to limit the total number of simultaneous connections that each client can establish with a specific virtual service, or the total number of simultaneous connections that all clients can establish with a specific virtual service.
Connection limit per client IP
Limits the number of connections received from each client IP to protect against malicious attacks. For example, certain interfaces of an application may consume significant resources. When an attacker initiates a large number of requests to that interface, the server may become overloaded and crash. In this case, setting a connection limit per client IP ensures that when the number of connections exceeds the limit, the system rejects new connections from that client, while existing connections and connections from other clients are not affected, ensuring the server continues to operate normally.
Total connection limit for a virtual service
For a given virtual service, an increase in the number of connections increases CPU and memory consumption on backend servers. When resource consumption increases without bound and reaches the server limit, current services are affected. Therefore, you can set a limit on the total number of connections accepted by a virtual service based on service requirements, to ensure the server operates normally.
As shown in the figure, the connection limit per client IP for virtual service 1 is 10 K, and the total connection limit for virtual service 2 is 100 K.
The number of concurrent connections from client 1 to virtual service 1 is less than 10 K, which is within the per-client IP connection limit, so the connection requests are accepted. The number of concurrent connections from client 2 to virtual service 1 exceeds 10 K, which exceeds the per-client IP connection limit, so the excess connection requests are rejected.
The total number of concurrent connections from client 1 and client 2 to virtual service 2 exceeds 100 K, which exceeds the total connection limit for the virtual service, so all connection requests are rejected.
