What TFO Solve

I got suggestion to enable Fast TCP Open (TFO) from a guy named Leonard Woo from Potatso Telegram User Group to possibly gain more speed on using Shadowsocks as I experienced a slowdown these couple of days.

TFO is one of congestion control algorithms of TCP connection out there. What TFO solves is about reducing RTT (round-trip-time) from handshaking that TCP connection normally needs. Citing from research paper which states that it can gain about 10% or in some cases up to 40%.

result of speed gain of TFO

How to Enable on Ubuntu

You need to have linux kernel at least 3.7.
You can check via uname -r, it will give the result similar to following.

3.13.0-24-generic

Then follow the following steps to enable Fast TCP Open

  • Edit /etc/sysctl.conf and add the following line to its end of file
   net.ipv4.tcp_fastopen = 3
  • Save a file.
  • Execute sysctl -p to make it taken into effect.
  • Make it permanent even after rebooting system by adding the following line into /etc/rc.local
   echo 3 > /proc/sys/net/ipv4/tcp_fastopen

But What's About Browser?

At first I thought that too that you have to have browser that supports TFO. But I consulted Leonard Woo and he said that it's Single side. That means only one side of the connection needs to enable TFO.

My understanding went through that you don't need TFO-enabled browser, but you need server provider to enable it. But if service provider doesn't enable TFO, your browser needs to have and enable it to gain benefit from what can give by TFO.

I checked on server side via 2 methods as stated in Monitoring Section in this article. Result is TFOConnection is there, and no failure! Thus it confirms what he said.

  • Execute ip tcp_metrics

fo_cookie

  • Execute grep '^TcpExt:' /proc/net/netstat | cut -d ' ' -f 87-92 | column -t

tfo metrics

Both result above confirm that it's a legit TFO connection.

I will be testing this set up for a couple days to see if I can gain such speed improvement (actually it's pretty difficult to tell as Internet speed through proxy/vpn is not stable from within China). But anyway, above is the way to enable it.

Reference