Opened 4 years ago

Last modified 3 months ago

#2 new TODO (General task list)

Improve TCP-over-TCP performance

Reported by: samuli Owned by:
Priority: minor Milestone:
Component: Networking Version: git master branch
Severity: Not set (if unsure, select this one) Keywords: TCP
Cc:

Description

Tunneling TCP over TCP without performance penalty is difficult. However, nothing is stopping us from trying.

Attachments (11)

direct-connection-1.pcap.bz2 (196.9 KB) - added by samuli 4 years ago.
Wireshark pcap file for a direct (non-openvpn) connection, part 1
direct-connection-2.pcap.bz2 (244.9 KB) - added by samuli 4 years ago.
Wireshark pcap file for a direct (non-openvpn) connection, part 2
openvpn-connection.pcap.bz2 (97.0 KB) - added by samuli 4 years ago.
Wireshark pcap file for a TCP-over-TCP via OpenVPN connection
Direct Connect.png (9.1 KB) - added by samuli 4 years ago.
Graph of a direct TCP connection
Direct Connect (2).png (8.7 KB) - added by samuli 4 years ago.
Another graph of a direct TCP connection
OpenVPN.png (10.2 KB) - added by samuli 4 years ago.
Graph of a TCP-over-TCP connection via OpenVPN
OpenVPN (2).png (10.2 KB) - added by samuli 4 years ago.
Another graph of a TCP-over-TCP connection via OpenVPN
Direct, TCP Window = Default.png (7.9 KB) - added by arrmo 4 years ago.
iperf results (arrmo), 1/4
Direct, TCP Window = 56 kBytes.png (8.0 KB) - added by arrmo 4 years ago.
iperf results (arrmo), 2/4
OpenVPN, TCP Window = Default.png (9.5 KB) - added by arrmo 4 years ago.
iperf results (arrmo), 3/4
OpenVPN, TCP Window = 56 kBytes.png (8.9 KB) - added by arrmo 4 years ago.
iperf results (arrmo), 4/4

Download all attachments as: .zip

Change History (15)

Changed 4 years ago by samuli

Wireshark pcap file for a direct (non-openvpn) connection, part 1

Changed 4 years ago by samuli

Wireshark pcap file for a direct (non-openvpn) connection, part 2

Changed 4 years ago by samuli

Wireshark pcap file for a TCP-over-TCP via OpenVPN connection

Changed 4 years ago by samuli

Graph of a direct TCP connection

Changed 4 years ago by samuli

Another graph of a direct TCP connection

Changed 4 years ago by samuli

Graph of a TCP-over-TCP connection via OpenVPN

Changed 4 years ago by samuli

Another graph of a TCP-over-TCP connection via OpenVPN

comment:1 Changed 4 years ago by samuli

Tunneling TCP traffic inside an OpenVPN TCP tunnel causes performance to drop significantly if the connection is unreliable (e.g. Internet). Unfortunately TCP-over-TCP is a necessity when the OpenVPN connection has to go through a proxy. The OpenVPN*.png pictures show a typical(?) throughput patterns for TCP traffic going through an TCP-based OpenVPN tunnel. As can be seen, at times throughput is good, but it often drops very low. This behavior apparently caused by the duplicated reliability layer of the nested TCP connections.

These issues have been discussed before on the mailing lists:

Any help with analyzing the logs or optimizing network settings to maximize OpenVPN TCP-over-TCP performance is most welcome!

comment:2 Changed 4 years ago by dazo

  • Component changed from component1 to Networking / routing (OS integration)
  • Keywords TCP added
  • Owner somebody deleted
  • Version set to openvpn-testing

comment:3 Changed 4 years ago by arrmo

Hi,

Here are some results, between two machines in my network. The results noted as "direct" are exactly that - a link between the two machines, without OpenVPN running. The "OpenVPN" results are then of course with OpenVPN running (between the same two machines, but traffic over OpenVPN).

Note the significant impact that the TCP Window size has on OpenVPN performance ... any thoughts?

Thanks!

Changed 4 years ago by arrmo

iperf results (arrmo), 1/4

Changed 4 years ago by arrmo

iperf results (arrmo), 2/4

Changed 4 years ago by arrmo

iperf results (arrmo), 3/4

Changed 4 years ago by arrmo

iperf results (arrmo), 4/4

comment:4 Changed 3 months ago by cron2

  • Severity set to Not set (if unsure, select this one)

So, has anyone in network research found a good approach to make tcp-over-tcp fast?

It works for OpenSSH tunneled stuff (-L/-R/-D) because they don't actually do tcp-over-tcp but terminate the connection on one end and build a new one on the other side.

We could do tcp-local-ack, but that would require fairly large new code to be written...

Note: See TracTickets for help on using tickets.