A developer building a high-performance SSH-based multiplayer game discovered that OpenSSH sends ~100 chaff packets per keystroke due to keystroke timing obfuscation (added in 2023). This feature sends SSH2_MSG_PING messages to servers advertising the ping@openssh.com extension, obscuring typing patterns from network observers. While valuable for privacy, it caused 66% of all packets to be overhead, doubling CPU usage and bandwidth. The fix was forking Go's x/crypto library to remove the ping@openssh.com extension advertisement, cutting total CPU from 29.9% to 11.6%, syscall time by 79%, crypto overhead by 93%, and bandwidth in half. The post also reflects on using Claude Code for network packet analysis.

9m read timeFrom eieio.games
Post cover image
Table of contents
Why does SSH send 100 packets per keystroke?DiscoveryInvestigationRoot causeRemediationDebugging with LLMs was fun

Sort: