[Cerowrt-devel] VPN technology in a bufferbloated universe is doomed

[Dave Taht]

Last puppy to shoot today...

I have adaquately proven to myself at least, that VPN technologies in
a bufferbloated universe, are doomed.

VPN streams over UDP cannot compete with GSO and TSO offloads without
some form of fair queuing and AQM that works.

Encapsulating TCP over TCP merely compounds the problem.

I wouldn't mind writing a paper demonstrating this fully, but in the
meantime I feel that pursuing vpn technologies as part of cerowrt is a
waste of time.

Additionally, no matter how hard people try, things like ipsec have
mysterious failure modes, and the additional protocols are frequently
blocked by institutions and end user devices.

Things like openvpn tend to work better than ipsec, but as I note
above, fail to compete effectively.

We have helped find and fix multiple problems in encapsulation over
the past year, but until we achieve our primary goals as an
organization - fixing bufferbloat - I strongly feel
that vpns are a doomed technology.





-- 
Dave Täht
SKYPE: davetaht
US Tel: 1-239-829-5608
FR Tel: 0638645374
http://www.bufferbloat.net