Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having performance problems using openshh(server) and putty(client) combination to use a remote webproxy. I'd like to disable encryption and test the results to see if it makes a difference. How can i do that? Is there anything i can modify in the sshd_config. I'm very new to openssh.

Any other ideas would be appreciated.

I've basically set my IE to use socks as a proxy. I connect my putty to my openssh server at home and voila - i'm able to browse the internet through that. However, it's increadibly slow even though I know I have a fast connection to my home (ftp for example works at above 50Kbytes/sec.


share|improve this question
It's a pity the rot13 patch ( never caught on... – Kenster Feb 25 '10 at 20:50
I highly doubt that the encryption used by SSH is the cause for your slow connection as long as your SSH server is not running on a digital wrist watch from 1980. – joschi Feb 26 '10 at 10:49

Without recompiling anything, it cannot be done as far as I am aware. You can however switch to ARC4 or Blowfish which are preposterously fast on modern hardware.

The BEST performance (as far as clock cycles are concerned) increase you can get is with adding

compression no

You can do this by changing

ciphers         aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,


ciphers         arcfour,blowfish-cbc

If you want to squeeze some extra performance out at the risk of incompatibility you can change

macs  hmac-md5,hmac-sha1,,


macs  hmac-md5-96

If you still think this is too much overhead, you could revert back to v1 or just do a standard VPN.

share|improve this answer
If your OpenSSH installation (on both ends) is complied with support for the "none" cypher, you can also specify that, but that defeats the whole purpose of secure shell. – voretaq7 Feb 25 '10 at 18:57
For the C-inclined among us, you can add in { "none", SSH_CIPHER_NONE, 8, 0, 0, EVP_enc_null } to cipher.c in the cipher array. – Zephyr Pellerin Feb 25 '10 at 19:45
I could also point out, You can use something like socat ( to do the same thing AND avoid all the SSH protocol overhead. – Zephyr Pellerin Feb 25 '10 at 19:47
I think umac-64 is the fastest of those mac algorithms. – James K Polk Feb 27 '10 at 20:36
96 bit MD5 is incredibly quick in any case. – Zephyr Pellerin Feb 28 '10 at 16:46

Unless the client or the server is drastically underpowered, I'd highly doubt that it's the encryption that is causing your performance issues. I use an "-D 8080" ssh socks proxy regularly and have never noticed anything but a very slight slowdown.

One thing to check is to see what the latency is between your client and the server. If it's a very latent connection, you would surely see poor performance over the tunnel when using HTTP, while not seeing performance problems with FTP. Once an FTP transfer is in progress, latency doesn't really matter, but with HTTP, you're dealing with web pages that may have 50 or more individual HTTP handshakes that need to happen. High-latency connections will really slow this process down and will make browsing unbearable.

So anyway, the recommendations that Zephyr Pellerin made are sound. If you really think that it's encryption that's causing the problem them by all means, switch to a different cipher. I'd suggest looking into latency first, though, as that seems to be a much more likely candidate.

share|improve this answer
+1 for this ... the problems highly unlikely to be the encryption and is more than likely going to be the connection to your host at home in the first place. – DaveG Feb 25 '10 at 20:02
I wish people would stop saying that you do not need to do this and get into a long discussions about the benefits and downfalls of encryption overhead (if or if not any), and just try and answer the question. I do not see a reason to add redundant encryption for my local task on my local machine for which I need at least authentication, but working from localhost to localhost is really not requiring encryption. – Marius Feb 24 '11 at 17:48
Not true, try to copy a large file using scp on a gig-ethernet. Intel iCore 5 load is 80 %. – lzap Jan 9 '12 at 15:56

This thread got me doing my own benchmarks and i found out that Performance varies not just by different cipher/MAC it also makes a difference what data you are sending, which CPU's are involved and how networking is set up.

So IMO the right thing to do is run your own tests and find the best settings for your situation.

If someone is interested, here are the results of my tests comparing an Intel E5506 driven Server with a Raspberry Pi:

-- Intel Xeon E5506(4 x 2.13 GHz), 50MB Random binary Data over localhost

cipher                      mac                        speed
aes192-cbc                  hmac-sha1                    50MB/s
arcfour256                  hmac-sha2-512              49.9MB/s
arcfour                     hmac-ripemd160             49.8MB/s
aes256-cbc                  hmac-sha1-96               49.7MB/s
aes128-cbc                  hmac-sha1-96               49.7MB/s
aes192-cbc                  hmac-sha1                  48.9MB/s
arcfour            48.8MB/s
aes256-cbc                  hmac-sha1-96               48.8MB/s
arcfour            48.7MB/s
aes128-cbc                  hmac-sha1                  48.4MB/s

-- Raspberry PI B+, 10MB Random binary over localhost

cipher                      mac                        speed
arcfour256                2.75MB/s
arcfour128                2.74MB/s
arcfour                   2.63MB/s
arcfour                   2.54MB/s
arcfour                     hmac-md5-96                2.36MB/s
arcfour128                  hmac-md5                   2.34MB/s
arcfour256                  hmac-md5                   2.34MB/s
arcfour256                2.33MB/s
arcfour256                  hmac-md5-96                2.28MB/s
arcfour256                  hmac-md5-96                2.22MB/s

But ony the 'top 10', the complete results can be found here.

share|improve this answer
results without the 'none' cipher are incomplete for this topic. I have many pogoplugv4 (800Mhz arm version = slow) and they often peg the cpu with ssh. this is why people seek the none cipher. ssh/sshd cpu usage at 100% means its not a network problem! i hope i remember to come back and post the cipher=none results... – user2420786 Apr 14 '15 at 12:19

I was able to compile sshd/ssh with cipher 'none' with the help of this post:

It's a very old post, but you have to make 3 slight modifications to the source code file cipher.c. Then recompile the sshd/ssh code.

@@ -175,7 +175,7 @@
    for ((p = strsep(&cp, CIPHER_SEP)); p && *p != '\0';
        (p = strsep(&cp, CIPHER_SEP))) {
        c = cipher_by_name(p);
-       if (c == NULL || c->number != SSH_CIPHER_SSH2) {
+       if (c == NULL || (c->number != SSH_CIPHER_SSH2 && c->number != SSH_CIPHER_NONE)) {
            debug("bad cipher %s [%s]", p, names);
            return 0;
@@ -343,6 +343,7 @@
    int evplen;

    switch (c->number) {
    case SSH_CIPHER_SSH2:
    case SSH_CIPHER_DES:
@@ -377,6 +378,7 @@
    int evplen = 0;

    switch (c->number) {
    case SSH_CIPHER_SSH2:
    case SSH_CIPHER_DES:

Also, the none cipher will need to be added to your /etc/ssh/sshd_config

Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc,,aes128-ctr,aes192-ctr,aes256-ctr,none

The links below will help you get ssh source for Debian and Ubuntu systems:

Credit to Dean Gaudet for being awesome

share|improve this answer

IF you want to try a completely unencrypted and uncompressed tunnel you could try using something like rinetd to forward the data instead of SSH. This would iliminate the SSH extras while stil offering a plain binary-safe tunnel for TCP connections.

When you say that you have a fast connection at home, are you sure that it is fast in both directions? Many home connections are very asymetric (my home ADSL for instance is ~11Mit downstream and ~1.5Mbit upstream and many are worse than that, some I can quote from friends/family connections: 7M/0.4M, 19M/1.3M, 20M/0.75M, ...). Remeber that if you are using home as a proxy the data has to go through your link both ways so will move at best at the slowest of your downstream and upstream speeds and you have a chunk of extra latency to factor in too. Also your ISP might deliberately throttle upstream communication (either blanket, or selectively so that things like email and selected popular web sites are not affected) as a way to discourage people running servers/proxies off their home links, though this is relatively rare.

share|improve this answer
ssh is standard on most machines. rinetd is not on some, but thanks for the suggestion. – Marius Feb 24 '11 at 17:50
then you should try netcat /nc – ThorstenS Jun 19 '14 at 14:30

According to this very nice blog post

I recommend to setup the following ciphers. Also make sure compression is off if you want the best performance on LAN. Please note this is possible security risk, use only on secure LAN (e.g. in home etc).

# cat ~/.ssh/config
Host 192.168.1.*
    Compression no
    Ciphers arcfour256,arcfour128,arcfour,blowfish-cbc,aes128-cbc,aes192-cbc,cast128-cbc,aes256-cbc

Modify the first line to list your own IPs in your LAN. You can also provide hostnames (separated by space). This gives you the best scp performance on LAN.

share|improve this answer

I've just done extensive testing on this, and the cipher suite that yielded the highest throughput was aes-128-ctr with umac64 MAC. On a 4-core 3.4GHz machine I saw almost 900MBytes/sec through localhost (to eliminate network bottlenecks for the sake of benchmarking)

If you really need that much performance, you want the newest SSH, and possibly the HPN-SSH patches.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.