Re: [Doh] DoT and DoH at Cambridge

[Tony Finch <[e-mail]>]

bert hubert <[e-mail]> wrote:
>
> Thanks for this experiment, I'd been hoping someone would run it! Of
> specific interest in terms of CPU sizing is how long the TLS connection
> stays open, if and how it resumes the TLS connection later on and perhaps
> what algorithms you see in use.

I have not done ANY tuning of this setup - defaults across the board on
nginx, and on BIND I have only increased the max concurrent `tcp-clients`
limit (or rather, I did that 4 years ago). I'm kind of winging it and
waiting to see how it grows :-)

With my setup (nginx as a TLS proxy) BIND controls the TCP session times
which in turn controls TLS session times; by default its idle timeout is
30s which is probably why that is a common session lifetime. I'm seeing a
good amount of session reuse, often lots of queries on the same
connection. Nicely done, Android :-)

Everyone is using TLS/1.2 ECDHE-RSA-AES256-GCM-SHA384.
I have configured nginx to use the "modern" TLS profile from
https://mozilla.github.io/server-side-tls/ssl-config-generator/

Tony.
-- 
f.anthony.n.finch  <[e-mail]>  http://dotat.at/
Faeroes, Southeast Iceland: Easterly or northeasterly 4 or 5, increasing 6 at
times. Slight or moderate. Rain or showers. Good, occasionally poor.