After Happy Eyeballs and QUIC, many fleets still hit plain TCP limits: MSS too large for tunnel PMTU, bufferbloat on long RTT paths, and SSH means that hide p95 pain until retransmits spike on big artifact pulls. This matrix covers only MSS clamp, BBR, and retransmit-aware sign-off—see the separate HE and QUIC checklist for UDP-side work.

For multi-region VPS and jump-host architects across JP, KR, HK, SG, US West. Also read GeoDNS SSH matrix, SCP/SFTP RTT matrix, and JumpHost HowTo. Below: a decision table, sysctl and ssh_config snippets with safety limits, regional rows, rollback, and FAQ.

1) Tunnels shrink PMTU but hosts keep large MSS → hidden fragmentation. 2) Cubic bastions versus BBR-friendly WANs → SCP stalls not seen in short tests. 3) Dashboards track SSH connect means, not TcpRetransSegs → artifact p95 drifts early.

TCP symptom Primary lever What you plot for p95 sign-off
Post-VPN spikes MSS clamp / tunnel MTU lock Retransmits flat; no ipfrag growth
Trans-Pacific SCP stalls BBR + fq on owned Linux hops SCP p95 up; RTT variance down
Shell OK, bulk bad Split jumps; IPQoS + keepalives Per-profile retransmit deltas
Looks like TCP, is GeoDNS Fix PoP before sysctl Failover time; knobs unchanged across move

Problem portrait: where MSS and BBR actually bite

Split control bursts (ssh, ProxyJump checks) from data bulk (scp over SSH). MSS pain hits bulk first; BBR without fq can starve shells on one host. Linux, BSD, and macOS differ—tune bastions you own, not customer Macs, unless policy allows sandboxes. Record kernel version on every hop so rollback scripts target the right module set for production builds only.

Parameter table, sysctl lab file, and ssh_config profile

Each row needs an owner, staging window, and flat post-promotion graphs.

Knob Start Pass if
MSS clamp PMTU minus headers; often 1200–1360 on overlays Retransmits down; SCP p95 up; drops flat
BBR + fq Dedicated Linux bastions only Queue delay down; no host-wide regression
Keepalives ServerAliveInterval 30, ServerAliveCountMax 4 Fewer mid-transfer resets
ConnectTimeout 8–12 s prod SSH p95 inside regional rows 
# /etc/sysctl.d/99-vpshalo-bbr-lab.conf — Linux bastions you control; staging 7d+; keep rollback copy
net.core.default_qdisc=fq
net.ipv4.tcp_congestion_control=bbr
# ~/.ssh/config — bulk profile
Host vpshalo-bulk-*
  HostName %h.edge.vpshalo.internal
  IPQoS throughput
  ServerAliveInterval 30
  ServerAliveCountMax 4
  TCPKeepAlive no
  Compression no
Boundaries: no BBR on shared hypervisors without vendor OK. Wrong-interface MSS clamp blackholes traffic. No secrets in samples. BBR does not replace MSS—canary both with captures.

Regional acceptance: JP, KR, HK, SG, US West

SSH p95: TCP connect through first remote byte. SCP p95: fixed test object same class as prod. Retransmit budget: TcpRetransSegs per GiB vs seven-day baseline—not SLAs.

PoP SSH p95 SCP p95 Retransmit budget
JP < 190 ms in-region jump Near domestic RTT model post MSS clamp No 2× baseline retransmits sustained
KR < 185 ms Clamp MSS if overlay MTU odd < 130% of JP ratio
HK < 175 ms GBA Mirror SG/JP origins No ipfrag storms after tunnel change
SG < 210 ms ASEAN BBR helps submarine tails Flat week-over-week
US West < 230 ms domestic AB test BBR on bastion with same object Spikes match carrier not builds

Rollback ladder when MSS or BBR trials misbehave

A Drop optional sysctl. B Restore old congestion module on bastion. C Revert MSS on the exact iface; verify with ping -M do. D Revert ssh_config bulk profile. E If still bad, fix GeoDNS capacity—not more TCP knobs.

Re-run stored scp and ssh probes after each step. If p95 not back in one business day, treat as routing or capacity.

FAQ: scope boundaries and common objections

BBR vs MSS? Different jobs—often both.

HE/QUIC? Use the other article; keep dashboards TCP-only here.

sysctl on Mac builders? Default deny; bastions first; sandboxes only if policy allows.

Five-step rollout for architects

  • 1 Seven-day baseline: retransmits, drops, SSH histo, SCP on fixed size per PoP.
  • 2 PMTU probe from bastions; MSS from minima not defaults.
  • 3 Canary BBR+fq one bastion per ocean; same SCP object.
  • 4 Ship bulk vs shell ssh_config via config manager.
  • 5 Sign-off pack: tables, rollback, pricing link for capacity.

Paste into runbooks

  • Clamp MSS for tunnel PMTU; add BBR for long fat pipes.
  • Chart retransmits per GiB beside SSH p95.
  • TCP deck here; HE/QUIC deck elsewhere.
Disclaimer: Heuristics not SLAs. Validate sysctl and OpenSSH against your distro matrix. Geo beats sysctl when charts disagree.

Match remote Mac PoPs to measured paths; vpshalo plans cover the same metros—keep probes after DNS or tunnel edits.

Nodes, help, and related Halo matrices

Turn TCP acceptance into a purchasing decision

Pricing · Help · Home. Related: HE/QUIC p95, GeoDNS SSH matrix.

Region purchase pages: Tokyo · Seoul · Hong Kong · Singapore · US West

Choose a regional node View plans Help center More Halo articles