Count hot destination pairs when reviewing Load Balancer SNAT pressure

Source facts

For TCP, Azure Load Balancer can reuse a SNAT port when the destination address or destination port differs. It cannot reuse that port for another active connection from the same backend to the identical destination address-and-port pair.

Microsoft warns that outbound bursts and a lack of application connection reuse increase exhaustion risk. When ports are exhausted, new outbound connections to a destination fail until a port becomes available. Microsoft Learn.

Applicability

Limit this analysis to TCP and identify the backend instance and actual outbound translation path. Separate concurrent connections to one busy service endpoint from connections spread across different destination pairs.

DSE recommendation

DSE recommends collecting per-destination concurrency and connection-creation patterns before changing a port allocation. Ask the application owner whether safe connection reuse is available and how it will be tested. Do not infer that two applications have equivalent SNAT demand merely because their total connection counts are equal. Record the busiest destination pairs alongside the approved outbound design.

Verification

In a controlled workload test, compare a concentrated destination pattern with a distributed pattern while keeping the relevant configuration visible. Observe new-connection failures, available port evidence and application behavior. Test an approved connection-reuse change separately and retain the measured result. Avoid turning a single successful request into proof that a sustained burst has enough outbound capacity.

Official references

Microsoft Learn: Source Network Address Translation (SNAT) for outbound connections. Source retrieved September 9, 2026.