feat(proto): Send NAT probes with off-path PATH_RESPONSE#619
Conversation
When we are NAT probing and we are sending a PATH_RESPONSE as a client, we include a PATH_CHALLENGE. This ensures that if the peer got through the firewall first that the client immediately gets through as well and can open the path. Speeding up NAT traversal.
|
Documentation for this PR has been generated and is available at: https://n0-computer.github.io/noq/pr/619/docs/noq/ Last updated: 2026-05-05T15:12:47Z |
Performance Comparison Report
|
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5741.9 Mbps | 7834.1 Mbps | -26.7% | 97.5% / 99.0% |
| medium-concurrent | 5502.3 Mbps | 7875.2 Mbps | -30.1% | 96.2% / 97.9% |
| medium-single | 4095.4 Mbps | 4635.4 Mbps | -11.6% | 97.2% / 99.0% |
| small-concurrent | 3853.6 Mbps | 5235.0 Mbps | -26.4% | 98.1% / 100.0% |
| small-single | 3586.6 Mbps | 4724.4 Mbps | -24.1% | 96.3% / 98.4% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 3188.8 Mbps | 4036.8 Mbps | -21.0% |
| lan | 782.4 Mbps | 810.3 Mbps | -3.4% |
| lossy | 69.9 Mbps | 69.8 Mbps | ~0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 23.8% slower on average
4d1c1d829f489884dab4678353e8c3fa4f42e5fc - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5940.6 Mbps | 7825.6 Mbps | -24.1% | 97.5% / 98.9% |
| medium-concurrent | 5375.9 Mbps | 7902.5 Mbps | -32.0% | 96.3% / 97.9% |
| medium-single | 3876.8 Mbps | 4748.8 Mbps | -18.4% | 96.8% / 98.7% |
| small-concurrent | 3856.9 Mbps | 5304.2 Mbps | -27.3% | 96.7% / 99.3% |
| small-single | 3561.1 Mbps | 4826.7 Mbps | -26.2% | 96.1% / 98.3% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 2929.7 Mbps | 4065.1 Mbps | -27.9% |
| lan | 782.4 Mbps | 810.3 Mbps | -3.4% |
| lossy | 69.8 Mbps | 55.9 Mbps | +25.0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 25.7% slower on average
6ca0d9ba4ad9de2cf6fb037503792c18f8ce544f - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5654.8 Mbps | 7841.8 Mbps | -27.9% | 94.6% / 98.8% |
| medium-concurrent | 5513.9 Mbps | 7956.6 Mbps | -30.7% | 94.7% / 100.0% |
| medium-single | 4208.7 Mbps | 4749.3 Mbps | -11.4% | 97.0% / 150.0% |
| small-concurrent | 3825.8 Mbps | 5249.0 Mbps | -27.1% | 100.1% / 155.0% |
| small-single | 3579.6 Mbps | 4805.3 Mbps | -25.5% | 93.1% / 102.0% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 3002.9 Mbps | 4132.0 Mbps | -27.3% |
| lan | 782.4 Mbps | 810.3 Mbps | -3.4% |
| lossy | 69.8 Mbps | 69.8 Mbps | ~0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 25.1% slower on average
ce60db700b6e5dd087227b2e121ea07d5c5351b1 - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5865.0 Mbps | 7918.0 Mbps | -25.9% | 97.1% / 98.7% |
| medium-concurrent | 5123.0 Mbps | 7822.1 Mbps | -34.5% | 96.4% / 98.0% |
| medium-single | 4055.7 Mbps | 4649.5 Mbps | -12.8% | 96.2% / 98.6% |
| small-concurrent | 3894.5 Mbps | 5459.1 Mbps | -28.7% | 97.8% / 99.8% |
| small-single | 3654.5 Mbps | 4775.6 Mbps | -23.5% | 96.3% / 98.6% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 3095.2 Mbps | 4091.2 Mbps | -24.3% |
| lan | 782.4 Mbps | 810.3 Mbps | -3.4% |
| lossy | 69.8 Mbps | 55.9 Mbps | +25.0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 25.4% slower on average
81f3e7a4adbebb91f76dad189c08f73316432588 - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5595.1 Mbps | 7956.7 Mbps | -29.7% | 96.9% / 98.6% |
| medium-concurrent | 5446.3 Mbps | 7666.2 Mbps | -29.0% | 97.7% / 99.0% |
| medium-single | 4191.1 Mbps | 4469.5 Mbps | -6.2% | 96.7% / 98.7% |
| small-concurrent | 3880.1 Mbps | 5106.8 Mbps | -24.0% | 97.9% / 99.8% |
| small-single | 3560.0 Mbps | 4584.1 Mbps | -22.3% | 95.8% / 98.0% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | N/A | 4065.1 Mbps | N/A |
| lan | N/A | 810.3 Mbps | N/A |
| lossy | N/A | 69.9 Mbps | N/A |
| wan | N/A | 83.8 Mbps | N/A |
Summary
noq is 23.9% slower on average
ca3086d5fc19c286b74da1409245d5e0e75215b8 - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5666.1 Mbps | 7909.0 Mbps | -28.4% | 97.4% / 151.0% |
| medium-concurrent | 5538.0 Mbps | 7854.1 Mbps | -29.5% | 97.1% / 149.0% |
| medium-single | 3966.3 Mbps | 4581.8 Mbps | -13.4% | 91.9% / 101.0% |
| small-concurrent | 3858.2 Mbps | 5167.7 Mbps | -25.3% | 94.3% / 102.0% |
| small-single | 3507.5 Mbps | 4850.3 Mbps | -27.7% | 94.5% / 102.0% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 3088.3 Mbps | 4016.4 Mbps | -23.1% |
| lan | 782.4 Mbps | 822.3 Mbps | -4.9% |
| lossy | 69.8 Mbps | 69.8 Mbps | ~0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 24.9% slower on average
885364d9a16438f9a5057c7e059fa9f29ef3aaf2 - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5686.8 Mbps | 7816.3 Mbps | -27.2% | 93.6% / 99.0% |
| medium-concurrent | 5553.7 Mbps | 7832.4 Mbps | -29.1% | 94.2% / 100.0% |
| medium-single | 3924.9 Mbps | 4749.2 Mbps | -17.4% | 95.0% / 101.0% |
| small-concurrent | 3919.2 Mbps | 5281.3 Mbps | -25.8% | 98.6% / 153.0% |
| small-single | 3584.9 Mbps | 4847.2 Mbps | -26.0% | 92.0% / 102.0% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 3142.2 Mbps | 4050.8 Mbps | -22.4% |
| lan | 782.4 Mbps | 810.3 Mbps | -3.5% |
| lossy | 69.8 Mbps | 55.9 Mbps | +25.0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 24.7% slower on average
4fd19674f23aff6daa0a555211282316fab33874 - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5896.9 Mbps | 7937.4 Mbps | -25.7% | 97.4% / 98.8% |
| medium-concurrent | 5823.5 Mbps | 7609.2 Mbps | -23.5% | 96.2% / 97.9% |
| medium-single | 3591.6 Mbps | 4658.8 Mbps | -22.9% | 96.1% / 98.6% |
| small-concurrent | 3853.4 Mbps | 5194.5 Mbps | -25.8% | 97.4% / 99.7% |
| small-single | 3525.6 Mbps | 4752.3 Mbps | -25.8% | 95.9% / 98.0% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 3058.6 Mbps | 4037.1 Mbps | -24.2% |
| lan | 782.4 Mbps | 810.4 Mbps | -3.4% |
| lossy | 69.9 Mbps | 55.9 Mbps | +25.0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 24.1% slower on average
4a5a299c5a612a93d1c50136630aebe69389f5e8 - artifacts
Raw Benchmarks (localhost)
| Scenario | noq | upstream | Delta | CPU (avg/max) |
|---|---|---|---|---|
| large-single | 5956.9 Mbps | 7893.4 Mbps | -24.5% | 93.7% / 99.0% |
| medium-concurrent | 5347.3 Mbps | 7809.0 Mbps | -31.5% | 93.3% / 100.0% |
| medium-single | 3881.6 Mbps | 4749.4 Mbps | -18.3% | 94.3% / 102.0% |
| small-concurrent | 3809.0 Mbps | 5271.4 Mbps | -27.7% | 99.4% / 154.0% |
| small-single | 3603.5 Mbps | 4732.5 Mbps | -23.9% | 90.2% / 98.0% |
Netsim Benchmarks (network simulation)
| Condition | noq | upstream | Delta |
|---|---|---|---|
| ideal | 3089.1 Mbps | 4028.6 Mbps | -23.3% |
| lan | 782.4 Mbps | 810.4 Mbps | -3.4% |
| lossy | 69.8 Mbps | 69.8 Mbps | ~0% |
| wan | 83.8 Mbps | 83.8 Mbps | ~0% |
Summary
noq is 24.9% slower on average
| // off-path PATH_RESPONSE. No need to schedule any retries for this, if NAT | ||
| // traversal is taking place then this remote is already is being probed with | ||
| // retries, this only speeds up a successful traversal. | ||
| if self |
There was a problem hiding this comment.
I'm not entirely sure what you wanted tested. But I've added a test that I kind of wanted. It turned out better than I expected, so thanks for the prompt.
There was a problem hiding this comment.
thanks, yeah that test is what I was thinking, just making sure there is a test that if I would delete your new code it would fail 😅
Description
When we are NAT probing and we are sending a PATH_RESPONSE as a
client, we include a PATH_CHALLENGE. This ensures that if the peer got
through the firewall first that the client immediately gets through as
well and can open the path. Speeding up NAT traversal.
Breaking Changes
n/a
Notes & open questions
Closes #570.
Also fixes an oversight from before: we were still consuming CIDs for
off-path responses. For now we want to not do that.
Change checklist