subtable entry expiry

Howdy,

I've a rate limiting iRule that adds expiring entries to a subtable and blocks a request if the size of the subtable is over a certain limit. hopefully no more detail is actually required here...

What we've been seeing is that if we permit this rule to allow 200 requests per second what we actually experience is a throughput of 100, not 200. This appears to be because entries in a subtable are not actually removed until a second after the entry time out reaches zero.

it looks to us like the entries on a subtable are only removed (and maybe added??) once per second, on some sort of schedule, rather than entries gracefully removing at the millisecond that their timer expires.

Basically we've found that we need to factor in an extra second in our coding logic to get the desired behavior. So when we want to permit 1 request a second, we actually can specify 2 per second, (or 10 in 9 seconds) knowing that the extra second where the subtable entry sits there on zero seconds will be forced into the equation. We tried permitting 1 per zero seconds, however this resulted in nothing being permitted. This initially sounds pretty obvious, but seemed like a potential solution given this scheduling behavior, but here it looks as if the entry is added to the table and instantly removed, as if the same interrupt that removed the entry would also remove it.

So yeah, allowing 10 in 9 seconds gives 1TPS, 2 in 1 second gives 1TPS and this is totally down to the internals of the table expiration logic. And if someone can comment on that, that'd be good, as whilst this iRule worked perfectly in testing, slowly stepping through 10 requests in 60 seconds, now we want 200TPS, it's a very different story.

Thanks

Chris