3 ms·
What makes in-line TLS difficult is that the NIC has to understand the TLS framing and the TCP segmentation for TSO. On top of that, what do you do if you have
by drewg123 9y ago
What makes in-line TLS difficult is that the NIC has to understand the TLS framing and the TCP segmentation for TSO. On top of that, what do you do if you have a re-transmission. The NIC has to re-download the entire 16KB TLS frame to re-send just a 1448b portion of it. So there are some challenges in terms of being able to find the entire TLS record, making sure to reference the entire thing so that it is all still there, etc. The "1 mbuf per TLS record" work I've done will make that a bit simpler, I hope.
- baybal2 9y ago>download the entire 16KB TLS frame to re-send just a 1448b portion of it. The bigger thing, is that TLS is far from ideal for video content, and TCP transmissions in general. It is much better to incorporate a degree of redundant coding, and tolerance to lost packets than rely on re-transmission. As you deal with a real-time content, there is a no real need for flow control. You either get packets in time, or your video feed cuts of. Another moment, for any genuinely live transmission, multicast beats down everything for efficiency, but why it is so hard to run multicast over open Internet is a discussion on its own.
- wmf 9y agoGiven that packet loss on the Internet tends to be very low, like 0.1%, retransmission is a lot more efficient than coding. Being able to build up your buffer faster than real time also helps with burst losses.