Why TCP Over TCP Is a Bad Idea (2001) • Hacker News Board

Re: Why TCP Over TCP Is a Bad Idea (2001)

#41

Post by throwaway41597 » Sun, Mar 29, 2015, 9:57 PM UTC

apenwarr wrote: post #39

seunosewa wrote: post #37

Earlier quoted context omitted.

Please explain how it avoids TCP-over-TCP. It doesn't seem to me that multiplexing multiple TCP connections over a single TCP link avoids the problem.

TCP congestion control fundamentally depends on packet loss to know when to slow down. If the outer TCP makes sure packet loss doesn't happen - because if it does, it retransmits - then the inner TCP won't know what's going on, and will send as fast as it can, creating a mess. The trick with sshuttle is that you terminate the TCP sessions at the server, and just send the raw data over the multiplexed link; there are…

I'm not totally sure I understand correctly:

1) a TCP packet from source IP S comes in on side A of your tunnel

2) instead of acknowledging the packet, side A only sends it as data to side B other TCP (ssh)

3) the data may get lost, in which case, the TCP connection between A and B retransmits

4) side B gets the data, forwards the packet to the destination IP D

5) D acknowledges, sends a packet to S

S --------- A ================= B ------------ D

When there is a lot of packet loss at step 3, the delay before S getting the acknowledgement sent at step 5 increases and S sees the congestion. Unlike TCP-over-TCP where A acknowledges packets from S as soon as it gets them.

Is that right?

Re: Why TCP Over TCP Is a Bad Idea (2001)

#42

Post by chias » Mon, Mar 30, 2015, 2:54 PM UTC

IgorPartola wrote: post #40

chias wrote: post #35

Earlier quoted context omitted.

So sitting at starbucks with my laptop -- what do i do? I am not aware of an option to have SSH run over UDP, although I do know that some VPNs allow you to use UDP instead of TCP. Unless there is a relatively simple way of getting an encrypted tunnel for my HTTP traffic using tools like ssh and netcat and other things I'm likely to already have installed, I disagree with the notion that it's never a good idea.

When you are running a SOCKS proxy through ssh, you are not doing TCP over TCP. We are talking about things like OpenVPN which can do TCP over TCP, but that is generally a bad idea. It's default mode is TCP over UDP, as it should be.

> When you are running a SOCKS proxy through ssh, you are not doing TCP over TCP

Are you sure? SSH uses TCP, and encapsulates the web traffic which also uses TCP... in what way is that not TCP over TCP?

Re: Why TCP Over TCP Is a Bad Idea (2001)

#43

Post by chias » Mon, Mar 30, 2015, 3:09 PM UTC

usaif wrote: post #34

TCP does what it's designed for: Reliable, ordered, stream connection with fixed end-points. UDP is the other extreme of this permutation. Wonder why no one explores the spectrum in between?

All of those properties are binary things -- it's either reliable or not reliable, ordered or not ordered, etc. The notion of mostly ordered or mostly reliable we sort of get "for free" with UDP. So then your question becomes: what about some properties and not others? There are ways around the fixedness of endpoints so I'll just look at reliability and ordered-ness.

Unreliable but ordered: use UDP, enumerate your packets, and if you get a packet out of order, discard it. No cheaper than UDP, and I can't really see a potential benefit over it.

Reliable but unordered: for this to make sense you have to impose a timeout (i.e. if you're willing to wait forever, UDP is reliable in that you can never be sure you won't ever receive that packet). So now you have ACKs and NACKs and you essentially have TCP minus congestion control and where you don't bother to re-order packets based on seq #. I can't really see the benefit of this either.

That said, there are many non-tcp-non-udp protocols out there. I just wouldn't say that the protocol-space is a spectrum with TCP on one side and UDP on the other -- there are many, many dimensions to look at.

Re: Why TCP Over TCP Is a Bad Idea (2001)

#44

Post by jerf » Tue, Mar 31, 2015, 5:33 PM UTC

chias wrote: post #42

IgorPartola wrote: post #40

Earlier quoted context omitted.

When you are running a SOCKS proxy through ssh, you are not doing TCP over TCP. We are talking about things like OpenVPN which can do TCP over TCP, but that is generally a bad idea. It's default mode is TCP over UDP, as it should be.

> When you are running a SOCKS proxy through ssh, you are not doing TCP over TCP Are you sure? SSH uses TCP, and encapsulates the web traffic which also uses TCP... in what way is that not TCP over TCP?

Here, read this: https://github.com/apenwarr/sshuttle#theory-of-operation

"TCP-over-TCP" and "TCP carried on something that happen to be TCP" turn out to be two very different things.

Re: Why TCP Over TCP Is a Bad Idea (2001)

#45

Post by chias » Mon, Apr 13, 2015, 7:30 PM UTC

jerf wrote: post #44

chias wrote: post #42

Earlier quoted context omitted.

> When you are running a SOCKS proxy through ssh, you are not doing TCP over TCP Are you sure? SSH uses TCP, and encapsulates the web traffic which also uses TCP... in what way is that not TCP over TCP?

Here, read this: https://github.com/apenwarr/sshuttle#theory-of-operation "TCP-over-TCP" and "TCP carried on something that happen to be TCP" turn out to be two very different things.

Thank you for the link :)