Distributed squads now pair designers in Tokyo with release engineers in Seattle and artifact hubs in Singapore. That pattern rewards a single observable surface for ingress instead of ad-hoc tunnels per vendor. Read this guide beside MSS and BBR for SSH artifact p95 and Happy Eyeballs and QUIC handshake budgets. Public follow-ups stay on help, pricing, and home.
1) Raw SSH exposes long-tail loss on Wi-Fi uplinks. 2) CONNECT adds TLS plus HTTP/2 scheduling that can hide loss until streams stall. 3) Parallel rsync jobs ignore stream budgets and collapse both designs into the same bad tail latency.
| Signal | HTTP/2 CONNECT carry | Direct SSH carry |
|---|---|---|
| First byte p95 | TLS plus CONNECT setup dominates; budget two round trips unless session resumption is proven | Single TCP session plus SSH KEX; sensitive to PMTU black holes on long fat pipes |
| Retransmit p95 | Keep under 0.8 percent of segments on the outer TLS socket during steady artifact pulls | Keep under 1.0 percent on the SSH socket; spike alerts when loss follows DNS flips |
| Concurrent streams | Cap client concurrency at sixteen streams per tunnel unless the proxy documents higher fairness | Model each shell and each SCP as one flow; multiplex with ControlMaster instead of naive parallel SCP |
| Artifact p95 | Measure end-to-end wall clock for a one gigabyte object separately from control channel heartbeats | Same one gigabyte fixture; compare against CONNECT path weekly to catch routing regressions |
Treat CONNECT as another regional PoP with its own congestion domain. Export histograms for TLS handshake time, stream creation latency, and per-stream bytes delivered into the same warehouse you already use for classic SSH so reviewers can compare apples to apples across JP, KR, HK, SG, and US West.
Path model: why CONNECT and SSH diverge under jitter
HTTP/2 CONNECT funnels bytes through an encrypted web front on anycast or GeoDNS edges. Laptops on flaky hotel Wi-Fi gain browser-grade TLS retries. The trade-off is scheduling: fifty parallel tunnels still contend on stream priorities.
Multiplexing discipline for mixed control and artifact traffic
Reserve low-numbered streams for interactive shells or git push operations. Schedule bulk rsync or scp transfers on separate connections when the proxy cannot guarantee weighted fairness. When agents poll health endpoints every few seconds, tag those requests so they never share a stream with a multi-gigabyte artifact lane.
Direct SSH avoids HTTP/2 fairness questions but couples everything to one TCP congestion window. Pair this path with the tuning knobs in MSS and BBR so single-flow stalls do not masquerade as application bugs.
Decision matrix: choose CONNECT, SSH, or hybrid per workload
Score each workload row before you change firewall policy. Security and networking leads both sign the row.
| Workload | Preferred path | Guardrail |
|---|---|---|
| Human developer shell | CONNECT when captive portals already allow HTTPS | Keep direct SSH as break-glass with hardware-backed keys |
| CI artifact backhaul | Hybrid: metadata over CONNECT, bulk over dedicated SSH or object storage | Never exceed stream budget without chunked uploads |
| Cross-region pair programming | CONNECT with session recording at the proxy | Mirror p95 metrics into the same dashboard as VNC latency |
# Synthetic probe outline (pseudo): measure TTFB for CONNECT vs SSH
# 1) curl --http2-prior-knowledge -x https://edge:443 -o /dev/null https://ssh.internal:22
# 2) ssh -o ConnectTimeout=5 internal 'echo ok'
# Emit both histograms with identical PoP labels.JP, KR, HK, SG, US West: acceptance rows for CONNECT vs SSH
Targets assume weekday business-hour traffic with synthetic five-minute probes every ten minutes. File an exception ticket before you widen windows or remove sampling.
| PoP | CONNECT first byte p95 | SSH first byte p95 | Retransmit ceiling |
|---|---|---|---|
| JP | < 210 ms | < 160 ms | 0.9 percent |
| KR | < 205 ms | < 155 ms | 0.9 percent |
| HK | < 195 ms | < 150 ms | 0.8 percent |
| SG | < 200 ms | < 158 ms | 1.0 percent |
| US West | < 185 ms | < 165 ms | 0.7 percent |
Six rollout steps for a Halo-style global ingress lane
- 1 Baseline both paths with identical fixtures from every corporate office VPN profile.
- 2 Label dashboards with outer PoP, inner region, and builder SKU so regressions trace to routing not CPU.
- 3 Enforce stream budgets on automation accounts and throttle parallel uploads inside CI templates.
- 4 Pair CONNECT ingress with GeoDNS health checks that fail over without sticky sessions longer than thirty seconds.
- 5 Run weekly one gigabyte artifact drills and alert when p95 slips more than twelve percent week over week.
- 6 Publish a single runbook that names owners for TLS edge, bastion SSH, and remote Mac disk queues.
Cite in reviews: sixteen streams per tunnel is the default fairness cap in many proxies. One gigabyte drills catch middlebox buffering. Twelve percent week-over-week regression triggers a rollback review.
When your matrix shows stable tails, place builders in the same metro as your operators using purchase, then narrow the cart to Tokyo, Seoul, Hong Kong, Singapore, or US West so evidence and checkout stay aligned.
Match PoP to the path that cleared your p95 matrix
All links below are public storefront and help pages without a login wall. Start from purchase for the Mac mini M4 monthly bundle, then align region with the rows you just signed. Use pricing for tier math, help for SSH and console onboarding, and home for product context.
Regional carts: Tokyo, Seoul, Hong Kong, Singapore, US West. Still researching? Return to the blog index for the rest of the Halo ingress series.