Re: FreeRADIUS RadSec TCP connection plateau at 505

--===============0674997984209080333==
Content-Type: multipart/signed;
	boundary="Apple-Mail=_C073C7DC-86AE-4AE2-A61E-1429415AAA94";
	protocol="application/pgp-signature";
	micalg=pgp-sha256


--Apple-Mail=_C073C7DC-86AE-4AE2-A61E-1429415AAA94
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8

On Apr 22, 2026, at 6:37=E2=80=AFAM, Tayyab Elahi =
<[email protected]> wrote:
> We're running FreeRADIUS 3.x as a RadSec terminator (TLS/TCP on port =
2083)
> in a Linux container, and we hit a hard ceiling at ~505 concurrent TLS
> connections. Looking for guidance on the recommended path forward.

  For one, please don't send 600Kb logs to the list.  No one is going to =
read all of that.

  The debug output is supposed to be used to debug policies for a few =
packets.  It's not supposed to be used to show "here's 1000 packets, all =
showing exactly the same problem"

> *Symptom (full logs attached):*
> Every new connection above ~505 is rejected.

  You don't need to show 500 connection attempts in the logs.

> *Root cause: *The #ifndef HAVE_KQUEUE branch in event.c uses select() =
+
> fd_set. On glibc, FD_SETSIZE and __FD_SETSIZE are hard-coded to 1024 =
in
> <bits/typesizes.h>, and sizeof(fd_set) is 128 bytes (1024 bits). Since =
each
> RadSec peer holds a persistent TCP FD, we run out at ~1000.

  Yes.

> *What we tried (none of it gets past 1024):*

  The 1024 limit is imposed by glibc.  You can't work around it by =
changing FreeRADIUS.

> 1. Is there any supported way on v3.x to use an event backend other =
than
> select() on Linux? I see the kqueue branch but no epoll branch.

  You can install libkqueue for Linux, and use that: =
http://packages.networkradius.com/extras/ubuntu/noble

  Or, supply patches to use epoll().

> 2. Does upgrading to v4 solve this =E2=80=94 i.e., can v4 handle =
5k=E2=80=9310k concurrent
> RadSec sessions on Linux out of the box?

  v4 requires libkqueue.  Among other things, it's API is a lot simpler =
than epoll.

> 3. Would an epoll backend patch for v3 (new #elif defined(HAVE_EPOLL)
> branch in event.c, replacing fd_set with an fd-indexed array) be of
> interest upstream, or is that out of scope for v3 maintenance?

  If the patch is small, we'll take it seriously.  If it deletes =
existing code or makes massive changes, it's a lot harder to integrate.

  i.e. we can't break peoples existing networks in order to add a =
feature that other people want.

> 4. Any deployment patterns people use to stretch v3 further, beyond =
tight
> idle_timeout / lifetime / cleanup_delay and sharding across multiple =
FR
> instances?
>=20
> *Environment:*
>=20
> - FreeRADIUS 3.x (event.c commit 92ab704b)
> - Linux, glibc (Debian-based container), Kubernetes
> - Single radiusd process, multi-threaded
> - TLS listener on 0.0.0.0:2083, virtual-server=3Dradius-tls
> - ~1000 long-lived RadSec sessions at steady state

  You likely want to close connections which aren't used. That will help =
a little bit.

  Alan DeKok.


--Apple-Mail=_C073C7DC-86AE-4AE2-A61E-1429415AAA94
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename=signature.asc
Content-Type: application/pgp-signature;
	name=signature.asc
Content-Description: Message signed with OpenPGP

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEIUl02elqcIsf1zM0v3SJ0h7dTTMFAmnou5oACgkQv3SJ0h7d
TTPIDQ/+IudnZDzp2/vf3rFYDvq2+qSkTALtpIYuUKxTv+lT134GYM7MmOCfUfTh
e7aTrbxyGKin/N4UXawLYe6dHDQlvU8cz9Xt4Imw3yM5BkvU3wTUiYv/bZVqziBU
GZuBuR9epPUozo+osnevd4lOUQhN1yaU646GCuJeJQ7/JAQa6w+lhHnYV/5CyyFF
6hAr3UqW2VR5DFgvw3KaxDP5Pq0bK6EGd7NEG/Jzi/d/L4gdTnnztC/tWGcIE+Ac
W0UsDz1gn3OsNspYrGrsWdi/DlXuznNovuVkIKi0CxS3b0vxdNKZQuyNWtK+K99D
Ycvrd09mlhiWuvyLu5jtSlMtI3xkU3X+ZMervUg+uk1ymSlzNcAILJ721VZy5Lmp
37fKCICnySFjZs02iY91gpmT/sDfE1c2pf3qqqvDZ3U2azYI1FZ0djqKWqarIP5S
Vu2x3UXsrgXtuJRR+9X7NCnBQ9kPxqjMc/Gt+TRiE6UJfSrBIom0DbDJLLmUgpj2
XsUPkIf/HbaOMbofN+5pMR9tQdVJ0+qh1Nl1VLbQu4Z2cWsGYVU6jOTuJeglPZbz
43GUx8dD0UP41VBFCsfvFL9MtM+iUWusMcedoterf0NgQKLi4IUN41SHkdS/Xq5J
TsBC61y4i6WLJ8jr5DP09QGcgy4nydRid76hh5uot+zjpvAf4NE=
=EfW7
-----END PGP SIGNATURE-----

--Apple-Mail=_C073C7DC-86AE-4AE2-A61E-1429415AAA94--

--===============0674997984209080333==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

--===============0674997984209080333==--