Jordan Whited 960cb50469 wgengine/wgcfg: size crypto & per-peer queues by CPU factor
To better balance throughput vs backlogged packet memory consumption.

These changes reduce peak RSS in UDP TX benchmarks that previously
regressed in 8fc6dca. All other benchmarks remain largely unchanged.
Netstack benchmarks are new, with back-tested results from 1e69418.

The following throughput and peak RSS benchmarks were performed with
iperf3 between two Intel i5-12400 nodes running Ubuntu 24.04 (Linux 6.8).

The UDP benchmarks did not use UDP GSO on the sender, so they were
roughly equivalent to single packet I/O through wireguard-go.

TCP/1 signifies one TCP stream; TCP/128 signifies 128 parallel TCP
streams. -NS signifies netstack, and -RX/-TX signify the side netstack
was running on, with the other being a natural TUN.

Change column is calculated against the oldest baseline (1e69418).

Throughput (Mb/s)
  Test            1e69418      8fc6dca  queue-size   Change
  TCP/1            10,371       11,354      11,407   +9.98%
  TCP/1-NS-TX       9,225       10,553      10,481  +13.61%
  TCP/1-NS-RX       8,573        9,097       9,002   +5.00%
  TCP/128           7,886        8,404       8,427   +6.85%
  TCP/128-NS-TX     4,613        6,408       5,448  +18.10%
  TCP/128-NS-RX     6,730        8,524       8,279  +23.02%
  UDP/1             2,111        2,853       2,751  +30.33%
  UDP/1-NS-TX       2,022        1,941       1,904   -5.85%
  UDP/1-NS-RX       2,087        2,444       2,261   +8.35%
  UDP/128           1,747        2,235       2,216  +26.87%
  UDP/128-NS-TX     1,325        1,615       1,424   +7.47%
  UDP/128-NS-RX     1,743        2,219       2,240  +28.50%

Peak memory (VmHWM, kB)
  Test           Side    1e69418      8fc6dca  queue-size   Change
  TCP/1          TX       98,240       52,596      52,508  -46.55%
                 RX      287,748       73,384      65,404  -77.27%
  TCP/1-NS-TX    TX      254,196       85,116      76,076  -70.07%
  TCP/1-NS-RX    RX      434,952       70,420      70,916  -83.70%
  TCP/128        TX      101,196       52,812      51,740  -48.87%
                 RX      290,420       63,620      62,716  -78.41%
  TCP/128-NS-TX  TX    1,499,200    1,199,304     821,740  -45.19%
  TCP/128-NS-RX  RX    3,945,960      475,276     153,516  -96.11%
  UDP/1          TX       58,864      160,840      58,060   -1.37%
                 RX      137,516       49,900      51,732  -62.38%
  UDP/1-NS-TX    TX      214,924      282,400      59,956  -72.10%
  UDP/1-NS-RX    RX      112,152       49,004      49,108  -56.21%
  UDP/128        TX       66,148      116,096      57,344  -13.31%
                 RX      154,384       56,556      57,572  -62.71%
  UDP/128-NS-TX  TX      187,096      225,080      88,628  -52.63%
  UDP/128-NS-RX  RX      156,108       74,556      75,952  -51.35%

Updates tailscale/corp#46716
Updates tailscale/corp#22467
Updates tailscale/corp#36989
Updates tailscale/corp#37878

Signed-off-by: Jordan Whited <jordan@tailscale.com>
2026-09-09 15:35:16 -07:00
2026-09-03 15:37:10 -07:00
2026-08-28 12:47:04 -07:00
2026-09-09 13:25:28 -07:00
2026-09-09 13:25:28 -07:00
2026-09-09 13:25:28 -07:00
2026-09-09 13:25:28 -07:00
2026-09-09 13:25:28 -07:00

Tailscale

https://tailscale.com

Private WireGuard® networks made easy

Overview

This repository contains the majority of Tailscale's open source code. Notably, it includes the tailscaled daemon and the tailscale CLI tool. The tailscaled daemon runs on Linux, Windows, macOS, and to varying degrees on FreeBSD and OpenBSD. The Tailscale iOS and Android apps use this repo's code, but this repo doesn't contain the mobile GUI code.

Other Tailscale repos of note:

For background on which parts of Tailscale are open source and why, see https://tailscale.com/opensource/.

Using

We serve packages for a variety of distros and platforms at https://pkgs.tailscale.com.

Other clients

The macOS, iOS, and Windows clients use the code in this repository but additionally include small GUI wrappers. The GUI wrappers on non-open source platforms are themselves not open source.

Building

We always require the latest Go release, currently Go 1.27. (While we build releases with our Go fork, its use is not required.)

go install tailscale.com/cmd/tailscale{,d}

If you're packaging Tailscale for distribution, use build_dist.sh instead, to burn commit IDs and version info into the binaries:

./build_dist.sh tailscale.com/cmd/tailscale
./build_dist.sh tailscale.com/cmd/tailscaled

If your distro has conventions that preclude the use of build_dist.sh, please do the equivalent of what it does in your distro's way, so that bug reports contain useful version information.

Bugs

Please file any issues about this code or the hosted service on the issue tracker.

Contributing

PRs welcome! But please file bugs. Commit messages should reference bugs.

We require Developer Certificate of Origin Signed-off-by lines in commits.

See commit-messages.md (or skim git log) for our commit message style.

About Us

Tailscale is primarily developed by the people at https://github.com/orgs/tailscale/people. For other contributors, see:

WireGuard is a registered trademark of Jason A. Donenfeld.

S
Description
No description provided
Readme BSD-3-Clause
173 MiB
0 Stars 1 Watchers 0 Forks
Languages
Go 96%
C 1.4%
TypeScript 0.9%
Shell 0.6%
Swift 0.3%
Other 0.5%