how many virtual IPs can be binded on a NIC

[Gary Yu]

Hi all,

I'm configuring iPlanet webserver on a A500 box with multiple URL supporting. each URL with https need a dedicated IP.

could anyone please let me know how many IP address I can configure on a single network adapter (like lan0:1, lan0:2 ...) -- we are using HPUX 11.0 with HP PCI 10/100BaseTX.

thanks,
Gary

[Steven E. Protter · Accepted solution]

I know of no limit other than that imposed by subnet masking

if the netmask for the interface is 255.255.255.0 then the most virtual interfaces you can have in addition to main is 252. That is for a total of 153.

Of course there comes a point where the configuration file becomes unmanagable.

SEP

[Mark Grant]

There may well be a limit but I've never heard of anyone hitting it. How many do you plan on having? In a service guard cluster, there are often many IP addresses on the same card.

[Sridhar Bhaskarla]

Gary,

I too have never heard of any such limit.

As a side note, if your network connection supports, you can have a different IP than the primary interface for the virtual interface using 'ifconfig lanx:#' command.

-Sri

[Steven E. Protter]

no points for this.

That last number was supposed to be 253

SEP

[Andrew Cowan]

I agree with SEP here, but would like to point out that whilst you can theoritcally have 253 (or more) addresses per interface. The limit may be (artificially) hit within the kernel with things such as the size of the routing tables etc.

I imagine that the performance would also be terrible as the amount of processing done by the kernel would climb exponentially?

[Gary Yu]

thank you guys very much for the confirmation and reminds, actually, performance and manageability are also a big concern to us in such scenario.

Gary

[rick jones]

I am aware of no hard-coded limit to the number of IPs that may be assigned to a given interface. The speed of adding those IPs may degrade as you increase their number, and indeed various hash chains may start to get rather long.

The kernel tunable tcphashsz may alter the size of some of the related hash tables. A description of that tunable may be in SAM, and there shoudl be one in some of the "tuning descriptions" online at www.spec.org for HP-UX SPECweb9* benchmark disclosures.

As for performance, I'm not familiar with the https performance of iPlanet. The https performance of ZWS can be quite good. There are a number of SPECweb99_SSL disclsoures, including some rather old ones on an A500 :) at www.spec.org. Youi may find some other useful tuning ideas in those disclosures.

I believe the only iPlanet SSL number there used a hardware crypto accelerator card.

I have a question about the wording of your intitial question though...

When you say "each URL wqith https need a dedicated IP" do you _really_ mean _each_ distinct URL on the system?!? That is a separate virtual server for every separate URL? Or do you mean you need to support many virtual https servers, each serving a number of URLs?

[Gary Yu]

thank you Rick.

Yes, with iplanet, if you don't want to see the ssl cert warnings in browser, you need to use IP based virtual server for each URL, but with version 6, you don't really need to configure a bounch of virtual servers, it can be achieved by just adding virtual "class" associated to the IP based listener sockets, inside a server configuration.