Benchmarks

A tunnel can run over UDP or TCP (see Transport Modes). These benchmarks measure how that choice affects throughput and latency for traffic flowing through a tunnel, especially as network conditions degrade.

tl;dr

UDP outperforms TCP on lossy, unpredictable networks — degraded wifi, mobile tethering, unstable VPNs, anything over the internet.

TCP has a raw throughput advantage on stable, predictable, low-latency networks where packet loss is not a concern.

The five most telling scenarios:

No Packet Loss or Latency

Single Connection

TCP is slightly faster for throughput. UDP has meaningfully lower latency. Downstream is lower than upstream because traffic arriving at the entry node requires extra processing to reconstruct into TCP connections.

Parallel Connections

With Packet Loss and Latency

Varying Loss

32 connections — a few parallel scans, SSH sessions, or file transfers.

Both transports survive at 32 connections, but the UDP transport is consistently faster.

64 connections — multiple scans in parallel, several RDP or SSH sessions.

The TCP transport drops to zero throughput at 5% loss. The UDP transport maintains throughput.

128 connections — dictionary attacks, full nmap scans, mass HTTP requests.

At 128 connections, the TCP transport collapses at very low packet loss. The UDP transport maintains throughput across all tested loss rates.

Varying Latency

32 connections

The TCP transport is faster at very low latency. As latency increases, the UDP transport takes over. Both survive across all latencies at 32 connections.

64 connections

At high latency, the TCP transport produces zero throughput.

128 connections

The TCP transport drops to zero throughput beyond low latency. The UDP transport remains stable across all latencies.

Varying Latency, No Loss

32 connections

64 connections

128 connections

Without loss, the TCP transport wins at low latency. As latency increases, the UDP transport takes over and the gap widens.

TCP Advantages

Strengths

Benefits from the OS kernel's highly optimised TCP stack. On stable, low-latency networks with negligible packet loss, it reaches gigabit-class throughput. At very low latency (e.g. same data centre), it outperforms UDP by a meaningful margin. It also traverses HTTP proxies and CDN infrastructure via WebSocket, which UDP cannot.

Trade-offs

Multiplexes all tunnel connections over a single TCP connection — one port, one connection, one queue. When a packet at the front of that queue is lost, every connection behind it has to wait for the retransmission. The more connections sharing the queue, the more likely any single packet loss stalls everything. This is called head-of-line blocking, and it is a fundamental property of TCP — not a flaw in the WebSocket transport itself.

UDP Advantages

Strengths

Under the hood, QUIC gives each tunnel connection its own independent stream. A lost packet only stalls the affected connection. Everything else continues uninterrupted. More connections means more independent recovery paths, which is why UDP throughput scales with connection count under loss while TCP throughput drops to zero.

Trade-offs

Slightly lower raw throughput on clean, low-latency networks compared to TCP.

Methodology

Traffic is generated with iperf3 through a full end-to-end tunnel with encryption active. Entry and exit run as QEMU microVMs on the same host with KVM. Throughput values are medians across multiple runs.

Packet loss and latency scenarios use tc netem on the entry VM's ethernet interface. Loss is applied on egress. All delay values are one-way — double them to get round-trip time.

To reproduce: just bench benchmark from the repo root. The benchmark harness, VM images, and network emulation scripts are all in the repository.