rustle against Squid
Same machines, same rules, one core each. rustle is first in 41 of 41 tests of the campaign; 31 of them run on both proxies, with the conditions next to every number.
3.6×
more requests per second at 1 KB
55,258 against 15,140 req/s
3.6×
less CPU per request
18.1 against 66.0 µs/req
9.6×
less memory with 25,000 open tunnels
95 against 912 MB
1 core per proxy · authentication on · Scaleway Elastic Metal, Paris, AMD EPYC 8224P · 25 Gbit/s private network (23.5 measured) · median of 3 runs · seed 2004113323 · campaign of 2026-10-28.
The short version
rustle had the better value in 31 of the 31 tests where both it and Squid ran. Squid was not ahead in any of them. In this campaign Squid has no HTTP/2 to clients, so the tests that need them are not in the tables. Every value is a median of 3 runs, with the exact figures in the tables below.
What each one supports
| Protocol | rustle | Squid |
|---|---|---|
| HTTP proxy and CONNECT tunnels | Yes | Yes |
| HTTPS proxy port (TLS) | Yes | Yes |
| HTTP/2 to clients | Yes | No |
| WebSocket upgrades | Yes | Yes |
As built and configured in the campaign, see “How Squid was run” below.
Test by test
Best clean concurrency level of each proxy. The last column is the ratio of rustle’s figure to Squid’s: how many times more or less. For memory and CPU, less is better.
Plain HTTP proxy port
| Test | rustle | Squid | Ratio |
|---|---|---|---|
| HTTP, 1 KB responsesreq/s | 55,258 | 15,140 | 3.6× more |
| HTTP, 10 KB responsesreq/s | 40,783 | 10,814 | 3.8× more |
| HTTP, 1 KB responses, a new connection per requestreq/s | 27,827 | 7,804 | 3.6× more |
| HTTP, 1 MB responsesreq/s | 2,624 | 353 | 7.4× more |
| HTTP, 10 MB responsesreq/s | 268 | 33 | 8.1× more |
| CONNECT tunnels, bulk transferGbit/s | 22.0 | 13.6 | 1.6× more |
| CPU cost per request (1 KB)µs/req | 18.1 | 66.0 | 3.6× less |
| Memory with 1,000 open tunnelsMB | 14 | 150 | 11× less |
| Memory with 5,000 open tunnelsMB | 40 | 275 | 6.8× less |
| Memory with 10,000 open tunnelsMB | 54 | 432 | 8.0× less |
| Memory with 25,000 open tunnelsMB | 95 | 912 | 9.6× less |
HTTPS proxy (resumed TLS sessions)
| Test | rustle | Squid | Ratio |
|---|---|---|---|
| HTTP, 1 KB responsesreq/s | 49,461 | 13,509 | 3.7× more |
| HTTP, 10 KB responsesreq/s | 35,460 | 9,341 | 3.8× more |
| HTTP, 1 KB responses, a new connection per requestreq/s | 6,119 | 2,047 | 3.0× more |
| HTTP, 1 MB responsesreq/s | 1,297 | 277 | 4.7× more |
| HTTP, 10 MB responsesreq/s | 142 | 27 | 5.2× more |
| CONNECT tunnels, bulk transferGbit/s | 12.0 | 4.9 | 2.5× more |
| Memory with 1,000 open tunnelsMB | 57 | 181 | 3.2× less |
| Memory with 5,000 open tunnelsMB | 253 | 432 | 1.7× less |
| Memory with 10,000 open tunnelsMB | 466 | 760 | 1.6× less |
| Memory with 25,000 open tunnelsMB | 810 | 2,584 | 3.2× less |
HTTPS proxy, full handshake on every connection
| Test | rustle | Squid | Ratio |
|---|---|---|---|
| HTTP, 1 KB responses, a new connection per request, full handshakereq/s | 5,458 | 1,922 | 2.8× more |
WebSocket, plain
| Test | rustle | Squid | Ratio |
|---|---|---|---|
| WebSocket, 64-byte messagesmsg/s | 58,506 | 43,710 | 1.3× more |
| WebSocket round trip, 64-byte messages (p99)ms | 1.3 | 1.5 | 1.2× less |
| CPU cost per WebSocket messageµs/msg | 17.1 | 22.9 | 1.3× less |
| WebSocket, 64 KB messagesGbit/s | 11.6 | 6.6 | 1.8× more |
| WebSocket, one connection per exchangemsg/s | 10,740 | 4,879 | 2.2× more |
WebSocket over TLS
| Test | rustle | Squid | Ratio |
|---|---|---|---|
| WebSocket, 64-byte messagesmsg/s | 56,955 | 36,786 | 1.5× more |
| WebSocket round trip, 64-byte messages (p99)ms | 1.3 | 1.8 | 1.3× less |
| WebSocket, 64 KB messagesGbit/s | 5.8 | 2.4 | 2.4× more |
| WebSocket, one connection per exchangemsg/s | 4,462 | 1,755 | 2.5× more |
These are the figures of one campaign, on one kind of traffic. What the numbers do not show, multi-core results and the other proxies
How Squid was run
Squid 7.7
from source, upstream's default flags, OpenSSL
- cache deny all, cache_mem 0
- tcp_recv_bufsize 1 MB, read_ahead_gap 1 MB
- forwarded_for delete, via off
- auth helper results cached 2 h
- workers N for N cores
- http_upgrade_request_protocols WebSocket and websocket allow all (authentication stays enforced by http_access)
What the campaign showed
- Authentication is not what limits it at 1 KB: 15,140 req/s with the auth helper against 15,395 without, at 64 connections.
- Drops an Upgrade offer unless http_upgrade_request_protocols allows it.
- No HTTP/2 towards clients.
- Scales 1 to 8 cores almost as well as rustle (x7.74 against x7.96), from a lower base.
Found a setting that makes Squid faster? Open an issue on the proxy repository: the campaign is built to be re-run.
Try rustle
Open source, fast, optimized, safe.