wiki:doc/FireFoxTorPerf

Version 10 (modified by trac, 9 years ago) (diff)

--

Hacking Firefox for Maximum Performance with Tor

Introduction

Tor is known for being secure but slow. If you want to improve browsing speed a bit, please follow the following simple instructions for tweaking the Firefox web browser's settings:

Procedure 1

First, open Firefox's advanced settings menu by running about:config from the address bar. Upon entering this address, you will see a long list of internal settings. Modify the following ones and set them to the suggested values shown here for maximum performance:

{{{ network.http.keep-alive.timeout:600 (300ms default is OK usually, but 600 is better.) network.http.max-persistent-connections-per-proxy:16 (Default is 4) network.http.pipelining:true (Default- false. Some old HTTP/1.0 servers can't handle it.) network.http.pipelining.maxrequests:8 (No default) network.http.proxy.keep-alive:true (Default- true, but double check) network.http.proxy.pipelining:true (Default- false) }}}

Afterwards, just restart the browser and experience the difference! For some automated additional performance hacks, check out FireTune. Currently, FireTune is only for Win32, but you can do the same tweaks manually with the help of this page. Additionally, there is the FasterFox extension that is easy to install, and is also platform independent!

Procedure 2 - an update and addendum to Procedure 1

These results were arrived at empirically, using the win32 bundle, Tor & Privoxy & Vidalia bundle: 0.1.2.5-alpha

You will need the following tools...

Tor Button - enable / disable TOR access in FireFox

This provides an optional button or text in the bottom right of the browser window in Firefox. This allows you to switch Tor on and off.

FasterFox - Modify performance related settings in FireFox

This plugin modifies the networking and cache settings for Firefox. The following settings need to be modified.

  • Initially you need to select 'Custom' in the FasterFox Options. This allows you to use your own detailed options, rather than the default schemes supplied.
  • Select the Cache tab.
    • Enter a Memory Cache Capacity of >= 8mb
    • Enter a Disk Cache Capacity of >= 8mb
  • Select the Connection tab
    • Enter Max Connection >= 128
    • Enter Max Connection Per Server >= 10
    • Enter Max Persistent Connection Per Server >= 8
    • Enter Max Persistent Connection Per Proxy >= 8
  • Select the Pipelining tab
    • Ensure all 3 tick options are enabled
    • Enter Max pipelining requests >= 10

Prio - Increase Vidalia / TOR process Priority (win32)

You will also realise a substantial increase in performance by increasing the process priority for the Vidalia process. You can do this in Task Manager after you identify vidalia.exe. If you want to persist the process priority you will need a Task Manager addon. This will allow the same process priority each time the OS loads Vidalia. An effective tool for doing this is Prio. This tool can only be used in a non-commercial setting, unless you license it. I dont recommend modifying the process above 'high'. If Vidalia crashes or freezes, the Windows OS will become unresponsive. Setting it to 'Above Normal' is a good start.

TCP/IP - Optimise 2K/XP's throughput (win32)

Windows XP has a self-tuning IP stack, but it can still benefit from a little help. Using the TCP Optimiser tool from above you can tune the RWIN, SACK OPTS (rfc 2038), and tcp1323opts controlling window scaling. The tool has one button optimise. This setting is sufficient to benefit from immediate increases to Tor throughput. To increase throughput further you can try experimenting with lower values of the IP TTL (Time To Live). Values as low as 32 will work and result in improved performance. Also try experimenting with smaller TCPWindowSizes. This setting is automatically adjusted when you move the slider marked 'Connection Speed' of the TCPOptimizer tool. Maximum throughput occurs when TCPReceiveWindow sizes < 65536 are applied. Currently theory is that above this size, TCP Receive Window Scaling comes into effect on Windows 2K/XP. The current theory is that TOR does not negotiate Scaling Receive Windows very well, which causes the IP stream to stall, reducing overall throughput.

Remove the limit on TCP connection attempts XP SP2 (win32)

Remove the limit on TCP connection attempts SpeedGuide.net has an interesting article detailing this restriction introduced in XP SP2. Microsoft have restricted the amount of half-open TCP/IP connections with the proviso that it would reduce the pace that worms spread. As noted by SpeedGuide, internet worms spread isotropically (multi-directionally) and so their infecton rate is exponential. As such, placing a constant (limit) on the rate of connection creation for every computer running XP SP2 will slow the rate of worms spreading (for that group of computers) but not by much. Consider the population of humans on the planet. Its over ~6 billion.

Supposing all these people are running Windows XP SP2, with rate limited half-open connections. To infect the entire population of computers would take: We are assuming optimum forward infection here. In the first second we have infected 10 machines. The 2nd second to elapse will cause (10 x 10) + 10 = 110 computers to be infected. The 3rd second to elapse would cause:

( (10 * 10) * 10 ) + (10 * 10) = 1100 computers to be infected. So the number of computers infected for every second that elapses is : computers infected = ~ 10 elapsedSeconds

In 12 seconds, we would have 10 12 = 1 billion computers infected. Full infection occurs before 13 seconds have elapsed !

This is all skewed by network topologies and routing algorithms, but they would affect a non-limited network in an identical manner. So the affect is a theoretical maximum of 13 seconds of additional notice to act against the worm. To all intents and purposes, this is useless.

Of much more interest is the effect on ANY network that relies on many open connections, such as Tor and a host of P2P applications. The effect here is a slow down of communications, with the limit acting as the catalyst.

Use the Event ID 4226 Patcher to mitigate against this.

DNS - reducing latency

For faster DNS performance generally (on win32 only i'm afraid) see...

When TOR starts it will report if it is using localhost to resolve DNS addresses. When you install FastCache, it sets up a local, cached and persistent store of DNS addresses. DNS resolves cost TOR a lot in terms of latency. A large part of TOR's reduction in speed is caused by setting up the path to the Onion routers that are servicing the request. Reduce DNS latency and the time cost of setting up the TOR channels are reduced.

Having completed testing, TOR addresses do appear in AnalogX FasterCache. FasterCache itself may prove unstable on occasion, with its icon stuck in its 'Red' - problem state. Try it and possibly update this page with your results.

--- N.B. the effect of FasterCache on TOR is still undetermined, although the 'DNS latency reduction' theory still applies. Also for all OS'es see...

Procedure 3

If you follow the previous authors work you should have well performing access. To go that bit further lets consider the ideal behaviour of our TOR client.

You will need: The on-line reference to TOR properties, that can be placed in torrc. Always back up this file before editing.

Lets think of a Service Level requirement we might like to place on our TOR client.

  • we want it to establish circuits as quickly as possible. If it takes too long ignore them, by timing out quickly.
  • now we have time-outs occuring frequently as we don't wait too long for circuits to establish, we need to encourage TOR to try to generate circuits more often.
  • we want TOR to only use circuits for a limited time. In the event the circuit becomes unstable, we don't want it lying around.
  • we can assume once a circuit has been established its likely a good one and we want it to stick around, until we time it out. Therefore we need to push a tiny amount of traffic down it, to keep it alive.

Given this SLA, lets come up with some properties that may help satisfy it.

  • CircuitBuildTimeout NUM

Try for at most NUM seconds when building circuits. If the circuit isn't open in that time, give up on it. (Default: 1 minute.) Set this to 5 seconds, forcing circuits that are quick to establish and thus likely to push traffic more quickly.

  • KeepalivePeriod NUM

To keep firewalls from expiring connections, send a padding keepalive cell every NUM seconds on open connections that are in use. If the connection has no open circuits, it will instead be closed after NUM seconds of idleness. (Default: 5 minutes) We'll set this to 5 seconds.

  • NewCircuitPeriod NUM

Every NUM seconds consider whether to build a new circuit. (Default: 30 seconds) We'll set this to the minimum value, so TOR is always ready to establish a new circuit.

The values to populate torrc with are as follows.

  • CircuitBuildTimeout 5
  • KeepalivePeriod 5
  • NewCircuitPeriod 1

The proof is in the pudding

With the changes made from Procedure 2 and 3, you can realise a sustained throughput of >100k, peaking at ~200k or more. These figures are based on the highest TOR bandwidth settings (>1.5mbps), through a 2mb connection. TOR at version 0.1.2.x uses an Asynchronous DNS resolver, the DNS tips above are still indeterminate for TOR traffic.