Work out session table size instantly with clear inputs, formula shown and shareable results.
Session table occupancy follows Little's law using the full lifetime, which includes the idle timeout — a session that finished 90 seconds ago still holds its entry until the timeout expires. With a 300-second idle timeout and 90-second sessions, three quarters of the table is dead weight, which is why timeout tuning is the cheapest way to reclaim firewall capacity.
Session table
entries = new sessions per second x (duration + idle timeout); active = rate x duration; memory = entries x bytes per entry
New connections are refused or existing sessions are evicted, which looks to users like random connection failures. It is also the mechanism behind state-exhaustion attacks.
Carefully. Long-lived idle connections such as database pools and SSH sessions break when the state is dropped, so use per-application timeouts rather than one global value.