Size Against Peak, Not Average
Averages hide the burst that drops sessions. A node sized for the mean sails through the working day and fails between 09:00 and 11:00, when every browser tab, background application, and API client opens connections at once. Bring the inputs from Resource Planning before using this page.Validate prerequisites
Confirm:- Peak concurrent connections are measured or estimated, not assumed.
- The HTTPS inspection scope is known — it changes CPU demand substantially.
- The log retention target is agreed. Use Log-Retention Planning.
- The candidate CPU supports AES-NI.
Read the sizing matrix
Size against peak concurrent connections, not average.
NIC counts are minimums. See the bonding guidance below.
Missing: these connection ceilings are undated in the legacy source and predate the current build. Treat them as a starting point for a measured pilot, not as certified capacity — escalate to the CTO before quoting a figure to a customer.
Require AES-NI
A CPU without AES-NI decrypts SSL 3 to 5 times slower, which produces latency spikes and dropped connections under HTTPS inspection load. Verify before committing to hardware:aes. An empty result means this CPU should not carry an inspecting proxy.
Estimate connections from user counts
Assume 3 to 5 concurrent connections per active user at peak. Heavy SaaS or streaming environments reach 6 to 8. For example, 200 active users at 5 connections each is 1,000 concurrent connections, which maps to 8 cores and 16 GB above. Average session duration is typically 3 to 5 minutes, with peaks between 09:00 and 11:00 and between 14:00 and 16:00. Size for the peak window, not the daily mean. Above 4,000 concurrent connections, assign multiple WAN IP addresses to avoid outbound NAT pool exhaustion, and evaluate Proxy Clustering rather than a single larger node.Choose the storage media
SafeSquid writes continuously for session logging, behavioural analysis, and threat detection. Storage media choice is a correctness concern, not only a performance one: when writes fall behind, log entries are delayed or missed, and the audit trail you depend on during an incident has holes in it. Use NVMe SSDs — M.2 or PCIe-attached — for these paths:
SATA-connected SSDs have substantially lower write throughput than PCIe-attached NVMe and cause logging delays and missed entries under load. Verify the attachment type, not just the label “SSD”.
Missing: per-scale disk capacity figures and daily log-volume estimates are not stated here — they exist in the legacy source but are undated and unverified against the current build. Escalate to the CTO before sizing storage from a number.
NIC, LACP, and routing checks
NIC, LACP, and routing checks
Use one interface for simple pilot deployments unless a separate management or high-availability design has been approved. For production networks with bonded interfaces, confirm switch-side LACP configuration, VLAN tagging, MTU, gateway selection, and failover behavior before routing users.Evidence should include interface names, MAC addresses, bond mode, switch ports, VLAN IDs, and the owner of any routing or firewall policy that forwards traffic toward SafeSquid.Link Aggregation Control Protocol (LACP) bonding combines physical interfaces into one logical link for bandwidth and redundancy. Without bonding, a single failed NIC can take the proxy offline entirely.Match the bonding layout to the number of physical ports available:
Bonding is configured on both the host and the switch. A host-side bond without matching switch-side configuration fails open or drops frames, so treat the switch change as part of the same change record.
Capture sizing evidence
Store these artifacts with the deployment record:- The peak concurrent-connection figure and how it was measured or estimated.
- The matrix row chosen, and the inspection scope it assumes.
grep aes /proc/cpuinfooutput for the target CPU.- Storage attachment type for each of the three write paths.
- Bond mode, switch ports, and VLAN IDs where bonding is used.
Troubleshoot sizing failures
Next steps
- Resource Planning - revisit the inputs if a figure here cannot be met.
- Proxy Clustering - scale out rather than up above 4,000 connections.
- Log-Retention Planning - size the log volume deliberately.