Re: [tsvwg] FQ & VPNs

[Bob Briscoe <[e-mail]>]

Jonathan,

On 19/02/2021 23:26, Bob Briscoe wrote:
> Jonathan,
>
> On 19/02/2021 22:11, Jonathan Morton wrote:
>>
>>> On 19 Feb, 2021, at 11:54 pm, Bob Briscoe <[e-mail]> wrote:
>>>
>>>> However, I would remind you that neither SFQ nor fq_codel can 
>>>> distinguish between flows carried inside an encrypted tunnel, so 
>>>> this cannot be relied upon alone to make L4S safe.  Pete's data 
>>>> shows significant tunnelled traffic, much of which is probably due 
>>>> to people working from home and using VPNs to access a corporate 
>>>> network.
>>> [BB] So would you not advise this ISP to remove the FQ on their 
>>> backhaul, given they are serving large amounts of tunnelled VPN 
>>> traffic?
>> No, of course not.  Max-min fairness is the gold standard, after all, 
>> and that is what FQ is designed to provide at a saturated 
>> bottleneck.  I honestly don't understand why you keep arguing, in 
>> effect, for RTT-fairness while promoting a specification which 
>> mandates working to eliminate it.
>>
>> At a bottleneck which is *not* persistently saturated, FQ serves to 
>> insulate latency-sensitive flows from bursty ones, and sparse flows 
>> from spurious AQM activity sparked by transient saturating loads.  
>> Are these not good things, even absent any rigorous notion of 
>> "fairness"?
>
> [BB] On a highly aggregated backhaul link that is only seeing 
> transient queuing (probably of the order of 10 or 100 us), there's 
> little need for an AQM at all.
>
> But if this backhaul link is capable of being saturated by the sum of 
> the access links (i.e. it's theoretically overbooked but relying on 
> average usage patterns to remain under-utilized), it would be 
> preferable to deploy a FIFO AQM there. With an FQ AQM, if a large 
> proportion of the traffic is in VPNs, just when the AQM is most 
> needed, it would makes matters worse (i.e. all the flows within the 
> VPNs would get a focused hit on their throughput, so they would 
> collectively cause massive queues within each per-flow-queue being 
> used by each VPN). 

Here is an algorithm to find the truth. Take one of your emails, and do 
a diff with the previous email in the thread. Then the other person's 
text that you silently deleted (as above) will invariably be the truth.


Bob

-- 
________________________________________________________________
Bob Briscoe                               http://bobbriscoe.net/