Making Tailscale Faster
Tailscale details upcoming Linux and Android performance optimizations, including zero-copy small packet handling, multi-queue routing, and netmap startup caching.
read it It provides concrete architectural details on how Tailscale is reducing memory overhead and CPU bottlenecks in its userspace networking pipeline.
summary
Tailscale outlines several upcoming data plane enhancements aimed at reducing memory overhead and boosting throughput for Linux and Android clients. By keeping small packets in a single large read buffer instead of copying them and introducing a multi-queue pipeline for subnet routers, the company reduces latency and CPU bottlenecks. Additional updates include utilizing Linux writev for vector-based packet passing and introducing netmap caching for faster client startup under poor network conditions. The post also notes plans to build a Tailscale-native performance testing toolkit to address current diagnostic gaps.
key points
- Tailscale now avoids copying small packets by identifying their boundaries inside 64 KiB read buffers, reducing memory overhead and yielding a 5 percent speed-up on Linux and Android.
- A new multi-queue architecture for subnet routers and app connectors distributes independent packet streams across multiple CPU cores rather than a single bottlenecked thread.
- Netmap caching stores network maps on disk, allowing clients in poor network conditions or on airplane Wi-Fi to start up and connect orders of magnitude faster.
- The co-founder notes in comments that userspace wireguard-go avoids some kernel-mode limitations, but heavy bandwidth cases will eventually require moving beyond current cryptographic formats.
who should read it
Systems engineers, infrastructure operators, and developers interested in userspace networking performance and VPN internals.
discussion positive
consensus
Commenters debate the merits of Tailscale's userspace wireguard implementation versus kernel-mode WireGuard, with co-founder apenwarr explaining why userspace remains flexible and competitive despite throughput complaints.
pushback
Several users complain about Tailscale hitting speed caps around 1Gbps to 10Gbps and causing high battery drain on mobile devices, arguing that kernel-level networking should be prioritized.
(Tailscale cofounder) I see a few comments here that using kernel wireguard would make it faster; it’s not really that simple. In fact, for a while (and we wrote a blog post about it), our optimizations made wireguard-go faster than kernel wireguard because it was better optimized. They adopted some of those improvements and now we’re on to the next order of magnitude together.
For really high bandwidth cases, things like DPDK are the long term best choice and are primarily userspace, for good reasons. Kernel mode is not the pure benefit it once was (if it ever was).
Separately, wireguard …
The co-founder clarifies why kernel WireGuard is not a silver bullet and discusses long-term scaling hurdles like hardware crypto acceleration limits.
Generated by an LLM from the article and thread. Check the sources before relying on it.