Envoy memory usage as TCP Proxy

[yang...@gmail.com]

Hi,

We're evaluating Envoy + OpenSSL as a TCP proxy. We are using the TCP Proxy filter with Upstream/Downsteam TLS and original source/dest filters. In our performance testing, we found the memory usage to be quite heavy. I'd like to get your feedback in case we are missing something.

In my setup, I use 4 worker threads and LDS to add listeners.

I tested adding up to 2000 listeners. Each new listener adds about 40KB physical memory.

I'm opening SSL connections from client side and let them sit idle (open socket but do not send data). I found that each 1000 connections adds about 153MB virtual memory and 60MB physical memory. All the connections are sending to the same host so I don't expect many hosts created.

Does this sound right to you? Any comments or suggestions is appreciated.

Thanks,

Yang