Networking

• Round-trip time (RTT): a packet's trip to the server and back.
• Each handshake waits for a reply, so it costs whole round trips.
• Bandwidth does not shorten a round trip.

A new HTTPS connection costs three round trips with TLS 1.3 before the response starts. A reused connection costs one.

TLS 1.2, TLS 1.3 and HTTP/2: measured in the lab. QUIC and 0-RTT: derived from RFC 8446, RFC 9000 and RFC 9001. A DNS miss adds lookups before all of them.

I count round trips: 4 for TLS 1.2, 3 for TLS 1.3, 2 for HTTP/3, and 1 on any warm connection.

distance

Frankfurt to northern Virginia: 6,550 km on the great circle.

fiber

Light in glass covers about 200 km per ms. RTT ≥ 2 × 6,550 / 200 ≈ 66 ms.

assumed

Edge 10 ms away; the server takes 50 ms. Both are example values.

Frankfurt to Virginia is at least 66 ms of RTT. A cold TLS 1.3 request pays it three times, so I end TLS at a nearby edge and keep the long link warm.

• Model: 20, 15 and 7 round trips. 7 × 80 ms = 560 ms.
• At a 1 ms RTT, the TLS 1.2 handshake took 3.9 ms and TLS 1.3 3.2 ms: CPU, not distance.

At an 80 ms RTT, five requests on one warm connection finished in less than half the time of five new TLS 1.3 connections.

DNS is cached, the two handshakes end at the load balancer, and everything behind the balancer runs on warm, pooled connections.

Each handshake adds whole round trips. Reuse removes them from every request after the first, and the saving grows with the RTT.

In the lab, the last fast HTTP/1.1 request finished at 238 ms. With HTTP/2 and a lost segment, every response took over 200 ms. HTTP/3: derived from RFC 9000. The 200 ms resend matches the Linux minimum retransmission timeout.

HTTP/2 fixes head-of-line blocking at the HTTP layer, but TCP still delivers bytes in order. One lost segment holds every stream on the connection, which QUIC avoids.

Over HTTP/1.1, browsers limit open connections per host, so many SSE tabs can block. Over HTTP/2, each stream shares one connection.

For server-to-client updates I use server-sent events. I use WebSocket when the client also sends often, and long polling only where neither works.

setup(protocol):                      // round trips before the request leaves
  TCP + TLS 1.2:   1 + 21
  TCP + TLS 1.3:   1 + 12
  QUIC (HTTP/3):   0 + 1              // transport and TLS in one3
  QUIC with 0-RTT: 0 + 0              // request in the first packet4

round_trips(protocol, n, reuse):
  IF reuse: RETURN setup + n          // pay the setup once5
  RETURN n × (setup + 1)              // pay it on every request

// Setup is the round trips a new connection costs before its first request can leave:
// the TCP handshake, then the TLS handshake.
func Setup(p Proto) (tcp, tls int) {
  switch p {
  case TCP, HTTP1:
    return 1, 0 // SYN, SYN-ACK
  case TLS12:
    return 1, 2 // hello and key exchange, then Finished both ways
  case TLS13, H2:
    return 1, 1 // the client sends its key share in the first hello
  case H3:
    return 0, 1 // QUIC runs the transport and TLS 1.3 handshakes together
  case H30RTT:
    return 0, 0 // the request rides in the first packet, with a resumed key
  }
  panic(fmt.Sprintf("unknown protocol %q", p))
}

// RoundTrips is the total for n requests sent one after another.
func RoundTrips(p Proto, n int, reuse bool) int {
  tcp, tls := Setup(p)
  if reuse {
    return tcp + tls + n // one setup, then 1 round trip per request
  }
  return n * (tcp + tls + 1) // every request pays the setup again
}

My latency estimate is setup round trips plus one per request, times the RTT. Reuse pays the setup once.

transfer_round_trips(bytes):          // new connection, no loss
  segments = ceil(bytes / 1460)       // MTU 1500 - 40 bytes of headers1
  window = 10                         // initial window, segments2
  rounds = 0
  WHILE segments > 0:
    segments -= window
    window = window × 2               // slow start doubles it3
    rounds += 1
  RETURN rounds

// TransferRounds is the round trips a new connection needs to deliver n bytes in slow start,
// with no loss: the window starts at 10 segments and doubles every round trip.
func TransferRounds(n int) int {
  segs := (n + MSS - 1) / MSS
  rounds, cwnd := 0, InitCwnd
  for segs > 0 {
    segs -= cwnd
    cwnd *= 2
    rounds++
  }
  return max(rounds, 1)
}

A new connection sends 10 segments, about 14 KB, in its first round trip, then doubles. Compression cuts round trips, not only bytes.

I keep connections warm at every hop. The service pools its connections, the balancer keeps them alive, and TLS ends at an edge near the user.

Rates: medians of three runs on an 8-core laptop, 8 clients, client and server on the same machine, so each handshake pays both sides' CPU. Runs varied by up to 1.6 times. The storm is an example: 100,000 clients that reconnect within 10 s.

I start with one server and keep-alive. I add a load balancer that ends TLS, then HTTP/2 between services, then edges near users, and HTTP/3 last.