Skip to content
Calcrivo

TACACS+ Session Calculator

Estimate TACACS+ request volume from device count, admin sessions and per-command authorisation.

Inputs

devices
sessions/day
commands
min
×

Concurrent Admin Sessions

3.33

TACACS+ Requests Per Day

32,800

Peak Request Rate

1.90requests/s

Requests Per Session

82

Accounting Records Per Day

16,800

Step by step

  1. Values used

    Managed network devices = 800 devices; Admin sessions per device per day = 0.5000 sessions/day; Commands per session = 40 commands; Average session length = 12 min; Peak-to-average factor = 5 ×

  2. TACACS+ Session

    requests per session = 2 for authentication plus 2 per command (authorisation and accounting).

  3. Concurrent admin sessions

    concurrent sessions = sessions per day × session minutes ÷ 1440

  4. Concurrent Admin Sessions

    = 3.33

  5. TACACS+ Requests Per Day

    = 32,800

  6. Peak Request Rate

    = 1.90 requests/s

  7. Requests Per Session

    = 82

  8. Accounting Records Per Day

    = 16,800

How it works

Unlike RADIUS, TACACS+ separates authentication, authorisation and accounting, and command authorisation fires on every command an operator types. Request volume is therefore driven by keystroke behaviour rather than by login count. Per-command authorisation multiplies AAA load by the commands per session, so an automation tool that runs hundreds of show commands across a fleet can overwhelm a TACACS+ server that comfortably handles human operators.

Formulas

TACACS+ Session

requests per session = 2 for authentication plus 2 per command (authorisation and accounting).

2
One authentication exchange and one session-start record
per command
TACACS+ authorises and accounts each command individually
requests per day
Sessions per day × requests per session

Concurrent admin sessions

concurrent sessions = sessions per day × session minutes ÷ 1440

1440
Minutes in a day
session minutes
Average length of an admin session

Frequently Asked Questions

How is TACACS+ Session calculated?

requests per session = 2 for authentication plus 2 per command (authorisation and accounting). Unlike RADIUS, TACACS+ separates authentication, authorisation and accounting, and command authorisation fires on every command an operator types. Request volume is therefore driven by keystroke behaviour rather than by login count.

Why does TACACS+ Session matter?

Per-command authorisation multiplies AAA load by the commands per session, so an automation tool that runs hundreds of show commands across a fleet can overwhelm a TACACS+ server that comfortably handles human operators.

What values do I need to enter?

This calculator takes 5 inputs: Managed network devices, Admin sessions per device per day, Commands per session, Average session length, Peak-to-average factor. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does automation break TACACS+ sizing?

Scripted collectors issue commands far faster than a person can type, and each one becomes an authorisation request plus an accounting record. Give automation its own privilege model or bypass per-command authorisation for read-only accounts.

You might also need

Related Calculators

RADIUS Capacity CalculatorLDAP Query CalculatorActive Directory Replication Calculator