The Hidden Costs of SSH at Scale (Remote Presentation)#

Brett Lykins – Amazon

• Why: SSH is the default automation transport, and this talk quantifies — with open-source benchmarks — what its 10–15 round-trip handshake actually costs across a WAN, then gives an adoptable fix that requires no device changes.
• What: Measured with tc netem at 150ms RTT: SSH PTY (Netmiko-style) takes 2,565ms before/around 5 commands vs 151ms for batched HTTPS — 17x. An edge proxy (SSH local at 1–2ms, HTTPS over the WAN) reaches 5.3x on new connections and 14.7x with reuse; a transparent tunnel (SSH on both ends, HTTPS only on the WAN segment) gets 12.7x with zero code changes to existing Ansible/Nornir. At 100k devices with 100 parallel lanes: 42.8 minutes down to 8.1.
• How: NAAS (Netmiko-as-a-Service) — a lightweight proxy co-located with devices, deployable via docker compose, 100+ platforms; device SSH keys never cross the WAN; treat it like a bastion (hardening, rotation, session logging). Migration path: tunnel first (no changes), proxy second, native HTTPS (eAPI/NX-API/RESTCONF) where supported. Decision framework included: <5ms RTT don't bother; 5–30ms measure first.
• Where applicable: Any WAN-distributed automation estate. Broadly applicable, no vendor dependence, benchmark and tool code open source (github.com/lykinsbd/clibench, /naas).