←back to thread

532 points tempaccount420 | 3 comments | | HN request time: 0.001s | source
Show context
Zambyte ◴[] No.45396281[source]
I was skeptical of the claim that it's faster than traditional SSH, but the README specifies that it is faster at establishing a connection, and that active connections are the same speed. That makes a lot of sense and seems like a reasonable claim to make.
replies(9): >>45396495 #>>45396529 #>>45396639 #>>45396881 #>>45400344 #>>45400909 #>>45400915 #>>45403285 #>>45410927 #
notepad0x90 ◴[] No.45396639[source]
Although, dollars-to-donuts my bet is that this tool/protocol is much faster than SSH over high-latency links, simply by virtue of using UDP. Not waiting for ack's before sending more data might be a significant boost for things like scp'ing large files from part of the world to the another.
replies(6): >>45396713 #>>45396823 #>>45397014 #>>45397091 #>>45397195 #>>45402450 #
nh2 ◴[] No.45397014[source]
SSH has low throughput on high latency links, but not because it uses TCP. It is because SSH hardcodes a too-small maximum window size in its protocol, in addition to the one of TCP.

This SSH window size limit is per ssh "stream", so it could be overcome by many parallel streams, but most programs do not make use of that (scp, rsync, piping data through the ssh command), so they are much slower than plain TCP as measured eg by iperf3.

I think it's silly that this exists. They should just let TCP handle this.

replies(4): >>45397148 #>>45397220 #>>45401266 #>>45402500 #
1. jlokier ◴[] No.45401266[source]
> I think it's silly that this exists. They should just let TCP handle this.

No, unfortunately it'snecessary so that the SSH proocol can multiplex streams independently over a single established connection.

If one of the multiplexed streams stalls because its receiver is blocked or slow, and the receive buffer (for that stream) fills up, then without window-based flow control, that causes head-of-line blocking of all the other streams.

That's fine if you don't mind streams blocking each other, but it's a problem if they should flow independently. It's pretty much a requirement for opportunistic connection sharing by independent processes, as SSH does.

In some situations, this type of multiplexed stream blockiing can even result in a deadlock, depending on what's sent over the streams.

Solutions to the problem are to either use window-based flow control, separate from TCP,, or to require all stream receive buffers to expand without limit, which is normally unacceptable.

HTTP/2 does something like this.

I once designed a protocol without this, thinking multipexing was enough by itself, and found out the hard way when processes got stuck for no apparent reason.

replies(1): >>45404036 #
2. nh2 ◴[] No.45404036[source]
Then:

* Give users a config options so I can adjust it to my use case, like I can for TCP. Don't just hardcode some 2 MB (which was even raised to this in the past, showing how futile it is to hardcode it because it clearly needs adjustments to people's networks and and ever-increasing speeds). It is extremely silly that within my own networks, controlling both endpoints, I cannot achieve TCP speeds over SSH, but I can with nc and a symmetric encryption piped in. It is silly that any TCP/HTTP transfer is reliably faster than SSH.

* Implement data dropping and retransmissions to handle blocking -- like TCP does. It seems obviously asking for trouble to want to implement multiplexing, but then only implement half of the features needed to make it work well.

When one designs a network protocol, shouldn't one of the first sanity checks be "if my connection becomes 1000x faster, does it scale"?

replies(1): >>45441728 #
3. jlokier ◴[] No.45441728[source]
I've just looked at the OpenSSH source, and I agree it should be configurable. That seems like an easy patch if you wanted to do it.

Or, better but more difficult, it should track the dynamic TCP window size, from the OS when possible, combined with end-to-end measurements, and ensure the SSH mux channel windows grow to accomodate the TCP window, without growing so much they starve other channels.

To your second point, you can't do data dropping and retransmission for mux'd channels over a single TCP connection. After data is sent from the application to the kernel socket, it can't be removed from the TCP transmission queue, will be retransmitted by the kernel socket as often as needed, and will reach the destination eventually, provided the TCP connection as a whole survives.

You can do mux'd data dropping and retransmission over a single UDP connection, but that's basically what QUIC is.