Use Little's law to turn a new-session rate and session lifetime into a firewall session table size.
Little's law says the population of a stable system equals arrival rate times residence time, so concurrent sessions follow directly from the new-session rate and how long sessions live. Inverting it gives the arrival rate at which the table fills. Firewalls and NAT gateways fail by exhausting the session table long before they run out of throughput, and idle-timeout settings drive residence time far more than user behaviour does.
Session Capacity
concurrent sessions = new sessions per second × average session duration (Little's law).
Rate the table can sustain
max sustainable rate = table size ÷ average duration
concurrent sessions = new sessions per second × average session duration (Little's law). Little's law says the population of a stable system equals arrival rate times residence time, so concurrent sessions follow directly from the new-session rate and how long sessions live. Inverting it gives the arrival rate at which the table fills.
Firewalls and NAT gateways fail by exhausting the session table long before they run out of throughput, and idle-timeout settings drive residence time far more than user behaviour does.
This calculator takes 4 inputs: New sessions per second, Average session duration, Session table size, Growth headroom. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.