# Count hot destination pairs when reviewing Load Balancer SNAT pressure

> For TCP, the destination address and port determine whether a translated source port can be reused by another active connection.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-252-count-hot-destination-pairs-when-reviewing-load-balancer-snat-pressure/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:44+00:00
- Modified: 2026-09-10T01:23:48+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

For TCP, the destination address and port determine whether a translated source port can be reused by another active connection.

## Potentially affected

TCP outbound connections from Azure Load Balancer backend instances using SNAT.

## DSE recommendation

Review concurrency by backend and destination address-port pair, not only total connection count.

## Article

## Source facts

For TCP, Azure Load Balancer can reuse a SNAT port when the destination address or destination port differs. It cannot reuse that port for another active connection from the same backend to the identical destination address-and-port pair.

Microsoft warns that outbound bursts and a lack of application connection reuse increase exhaustion risk. When ports are exhausted, new outbound connections to a destination fail until a port becomes available. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections).

## Applicability

Limit this analysis to TCP and identify the backend instance and actual outbound translation path. Separate concurrent connections to one busy service endpoint from connections spread across different destination pairs.

## DSE recommendation

DSE recommends collecting per-destination concurrency and connection-creation patterns before changing a port allocation. Ask the application owner whether safe connection reuse is available and how it will be tested. Do not infer that two applications have equivalent SNAT demand merely because their total connection counts are equal. Record the busiest destination pairs alongside the approved outbound design.

## Verification

In a controlled workload test, compare a concentrated destination pattern with a distributed pattern while keeping the relevant configuration visible. Observe new-connection failures, available port evidence and application behavior. Test an approved connection-reuse change separately and retain the measured result. Avoid turning a single successful request into proof that a sustained burst has enough outbound capacity.

## Official references

[Microsoft Learn: Source Network Address Translation (SNAT) for outbound connections](https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections). Source retrieved September 9, 2026.

## Primary reference

- Name: Source Network Address Translation (SNAT) for outbound connections - Azure Load Balancer | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-outbound-connections
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Count hot destination pairs when reviewing Load Balancer SNAT pressure,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-252-count-hot-destination-pairs-when-reviewing-load-balancer-snat-pressure/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.