Session Capacity Calculator
Use Little's law to turn a new-session rate and session lifetime into a firewall session table size.
Inputs
Concurrent Sessions
120,000
Planned Sessions With Growth
150,000
Session Table Utilisation
15.0%
Spare Table Entries
850,000
Max Sustainable New-Session Rate
16,667sessions/s
Step by step
Values used
New sessions per second = 2,000 sessions/s; Average session duration = 60 s; Session table size = 1,000,000 entries; Growth headroom = 25 %
Session Capacity
concurrent sessions = new sessions per second × average session duration (Little's law).
Rate the table can sustain
max sustainable rate = table size ÷ average duration
Concurrent Sessions
= 120,000
Planned Sessions With Growth
= 150,000
Session Table Utilisation
= 15.0
Spare Table Entries
= 850,000
Max Sustainable New-Session Rate
= 16,667 sessions/s
How it works
Little's law says the population of a stable system equals arrival rate times residence time, so concurrent sessions follow directly from the new-session rate and how long sessions live. Inverting it gives the arrival rate at which the table fills. Firewalls and NAT gateways fail by exhausting the session table long before they run out of throughput, and idle-timeout settings drive residence time far more than user behaviour does.
Formulas
Session Capacity
concurrent sessions = new sessions per second × average session duration (Little's law).
- new sessions per second
- Arrival rate λ
- average session duration
- Mean time in system W
- concurrent sessions
- Population L = λW
Rate the table can sustain
max sustainable rate = table size ÷ average duration
- table size
- Maximum entries the device holds
Frequently Asked Questions
How is Session Capacity calculated?
concurrent sessions = new sessions per second × average session duration (Little's law). Little's law says the population of a stable system equals arrival rate times residence time, so concurrent sessions follow directly from the new-session rate and how long sessions live. Inverting it gives the arrival rate at which the table fills.
Why does Session Capacity matter?
Firewalls and NAT gateways fail by exhausting the session table long before they run out of throughput, and idle-timeout settings drive residence time far more than user behaviour does.
What values do I need to enter?
This calculator takes 4 inputs: New sessions per second, Average session duration, Session table size, Growth headroom. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
You might also need
- Flow Count CalculatorCommonly used together
- Connection Timeout CalculatorCommonly used together
- Connection Capacity CalculatorCommonly used together
- SYN Flood Capacity CalculatorCommonly used together
- Packets Per Second CalculatorAlso in TCP & Transport
- Bandwidth Delay Product CalculatorAlso in TCP & Transport