Estimate TACACS+ request volume from device count, admin sessions and per-command authorisation.
Unlike RADIUS, TACACS+ separates authentication, authorisation and accounting, and command authorisation fires on every command an operator types. Request volume is therefore driven by keystroke behaviour rather than by login count. Per-command authorisation multiplies AAA load by the commands per session, so an automation tool that runs hundreds of show commands across a fleet can overwhelm a TACACS+ server that comfortably handles human operators.
TACACS+ Session
requests per session = 2 for authentication plus 2 per command (authorisation and accounting).
Concurrent admin sessions
concurrent sessions = sessions per day × session minutes ÷ 1440
requests per session = 2 for authentication plus 2 per command (authorisation and accounting). Unlike RADIUS, TACACS+ separates authentication, authorisation and accounting, and command authorisation fires on every command an operator types. Request volume is therefore driven by keystroke behaviour rather than by login count.
Per-command authorisation multiplies AAA load by the commands per session, so an automation tool that runs hundreds of show commands across a fleet can overwhelm a TACACS+ server that comfortably handles human operators.
This calculator takes 5 inputs: Managed network devices, Admin sessions per device per day, Commands per session, Average session length, Peak-to-average factor. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Scripted collectors issue commands far faster than a person can type, and each one becomes an authorisation request plus an accounting record. Give automation its own privilege model or bypass per-command authorisation for read-only accounts.