Skip to content
ENExplore Calculators

TACACS+ Session Calculator

Estimate TACACS+ request volume from device count, admin sessions and per-command authorisation.

About TACACS+ Session Calculator

Unlike RADIUS, TACACS+ separates authentication, authorisation and accounting, and command authorisation fires on every command an operator types. Request volume is therefore driven by keystroke behaviour rather than by login count. Per-command authorisation multiplies AAA load by the commands per session, so an automation tool that runs hundreds of show commands across a fleet can overwhelm a TACACS+ server that comfortably handles human operators.

Formulas

TACACS+ Session

requests per session = 2 for authentication plus 2 per command (authorisation and accounting).

2
One authentication exchange and one session-start record
per command
TACACS+ authorises and accounts each command individually
requests per day
Sessions per day × requests per session

Concurrent admin sessions

concurrent sessions = sessions per day × session minutes ÷ 1440

1440
Minutes in a day
session minutes
Average length of an admin session

Worked example

With the default values below, TACACS+ Session Calculator returns Concurrent Admin Sessions of 3.33. Change any input above and every figure here is recalculated in your browser.

Inputs used

Managed network devicesminimum 1 devices
800 devices
Admin sessions per device per dayminimum 0.001 sessions/day
0.5 sessions/day
Commands per sessionminimum 1 commands
40 commands
Average session lengthminimum 0.1 min
12 min
Peak-to-average factoraccepts 1–40 ×
5 ×

Results

Concurrent Admin Sessions
3.33
TACACS+ Requests Per Day
32,800
Peak Request Rate
1.90 requests/s
Requests Per Session
82
Accounting Records Per Day
16,800

Step by step

  1. 1Values used
  2. 2TACACS+ Session
  3. 3Concurrent admin sessions
  4. 4Concurrent Admin Sessions= 3.33
  5. 5TACACS+ Requests Per Day= 32,800
  6. 6Peak Request Rate= 1.90 requests/s
  7. 7Requests Per Session= 82
  8. 8Accounting Records Per Day= 16,800

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is TACACS+ Session calculated?

requests per session = 2 for authentication plus 2 per command (authorisation and accounting). Unlike RADIUS, TACACS+ separates authentication, authorisation and accounting, and command authorisation fires on every command an operator types. Request volume is therefore driven by keystroke behaviour rather than by login count.

Why does TACACS+ Session matter?

Per-command authorisation multiplies AAA load by the commands per session, so an automation tool that runs hundreds of show commands across a fleet can overwhelm a TACACS+ server that comfortably handles human operators.

What values do I need to enter?

This calculator takes 5 inputs: Managed network devices, Admin sessions per device per day, Commands per session, Average session length, Peak-to-average factor. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does automation break TACACS+ sizing?

Scripted collectors issue commands far faster than a person can type, and each one becomes an authorisation request plus an accounting record. Give automation its own privilege model or bypass per-command authorisation for read-only accounts.

Related Calculators

TACACS+ Session Calculator | Calcrivo