Testing TCP_FASTOPEN

SteveMC

Hi,

Is there a way to know if TCP_FASTOPEN is effectively being used? I configured my server to enable it , for both client and server, and activated it in nginx. Then how can I know if it's really being used?

Thank you.

solaire

Tcpdump / Wireshark?

eol

Good question.

SteveMC

I understand that only Chrome for Android / Linux has the TCP_FASTOPEN feature enabled. And apparently, "at a time", Edge had this option which could be turned on / off. But I can't find any more.

Unrelated, but I just started using TLSv1.3 and I could see a slight and nice improvement. Still waiting for HTTP/3 (formally HTTP-over-QUIC).

rm_

SteveMC said: Then how can I know if it's really being used?

With tcpdump evidently, but to see if there's any improvement from it, just get two VPSes with a high ping between each other (such as Japan and Europe), run HTTP server on one, run time curl -I on another, both with FASTOPEN disabled and enabled.

zllovesuki

To be honest, nobody should use TCP_FASTOPEN in production environment. With current TLS 1.1/1.2 deployments, TFO is the enemy of firewalls. However, I do see the usefulness in TLS 1.3 false start with TFO. But as of right now, I personally don't see the applications of TFO.