TCP Connection Limit Unclear for Azure Web App

Hey Mora, this confusion is common.

Those three numbers come from different measurements and scopes: Azure’s documented “outbound IP connections per instance” is an ephemeral port / SNAT guidance, Metrics → Connections shows an aggregated socket count the App Service host reports, and Diagnostics → TCP Connections can show per-process / per-endpoint snapshots (and may surface a smaller per-process limit hit). Add to that NAT Gateway SNAT port limits (and number of public IPs assigned) and you get more divergence — the app can hit SNAT exhaustion even though the host socket count looks lower.

What to do next: check per-instance and per-process sockets from the instance (Kudu SSH or netstat -an), enable the App Service Diagnose and solve TCP tools, review NAT Gateway SNAT usage (Standard NAT Gateway + extra Public IPs increase SNAT ports), reuse connections (HTTP keep-alive / HttpClient pooling), and scale-out to reduce per-instance pressure. If numbers still don’t add up, open a support ticket with subscription, region and timestamps so platform logs can be checked.

Hope this helps

Hi @Mora

The numbers don’t match because each metric is counting different types of connections from different parts of the system.

• Web App → Connections
  • This shows HTTP/WebSocket connections coming into your app. It is counted at the App Service front-end, not at the OS level. this number is typically higher because it includes logical client connections hitting your app.
• App Service Plan → Socket Count
  • This shows all TCP sockets on the VM, including: inbound, outbound, loopback, system/internal sockets. Some sockets are extremely short-lived and may not appear in FE metrics. So this number is from the underlying worker machine, not just your app. this value reflects OS-level socket usage, not the logical app connection count.
• TCP Diagnostics
  • This is a snapshot at one moment. It only shows the sockets that were open exactly at that sampling time. It does not include inbound or internal sockets. This is expected to be smaller than both app-level and plan-level metrics.
• The diagnostic warning about “maximum outbound connections” is typically due to SNAT port limits, not the web app hitting its own connection limits. So you may see small outbound counts in diagnostics, but still experience SNAT exhaustion depending on how your app opens/holds connections.

I hope this information helps address your query.