The limit was the encryption, not the network: switching ciphers tripled the upload
Date:Oct 15, 2026Server:cPanel test server (OpenSSH 7.4) and ZFS storage on the internal networkReading time:2 minTopic:Performance
The question
Every minute the backup spends uploading is another minute sharing the server with the sites, in a nightly window that grows with the number of accounts.
Does the ~90 MB/s ceiling per SSH connection, measured in Lab 05, come from the network or from the encryption SSH uses by default?
Result
3×switching ciphers took one connection from 78 MB/s to 245 MB/s
867 MB/swith 4 connections (~7 Gbit/s): the network was not the limit
Why it matters to whoever runs the server
Just switching ciphers took one connection from 78 to 245 MB/s: no new hardware, no new network. With 4 connections, 867 MB/s.
Salvo already uses that cipher. Tools that use SSH with the default settings, like rsync, stay on the slower one unless someone changes it by hand: speed the server already has and doesn’t use.
SSH upload by cipher and number of connections2 GB random file, discarded at the destination · higher is better
1 connection, default cipher
78 MB/s
1 connection, aes128-gcm
245 MB/s
2 connections, default cipher
184 MB/s
2 connections, aes128-gcm
495 MB/s
4 connections, aes128-gcm
867 MB/s
Source: Salvo Lab · cPanel test server and ZFS storage · Oct 15, 2026
See the data as a table
Connections
Cipher
Total
1
OpenSSH default (chacha20-poly1305)
78 MB/s
1
aes128-gcm
245 MB/s
2
default
184 MB/s
2
aes128-gcm
495 MB/s
4
aes128-gcm
867 MB/s
Method
The same pair of machines as Lab 05: a cPanel test server (CentOS 7, OpenSSH 7.4) sending to a ZFS backup storage on the internal network.
A 2 GB file of random data, sent over SSH and discarded at the destination, so the disk stays out of the measurement.
Run after the last backup of that hour had finished.
What we decided
Salvo uses the Go language’s SSH, which already picks aes128-gcm first, the cipher the processor accelerates. Tools that use OpenSSH with its default configuration, such as rsync, stay on the slower cipher on this path unless someone changes the cipher by hand.
?
What we don’t know yetThis was a network and encryption test, with no disk: the storage disk wrote at 75 to 91 MB/s outside the backup window (Lab 05) and may become the limit at night. We haven’t yet measured the engine’s own upload with several connections. One connection with the default cipher gave 78 MB/s here and 89 MB/s in Lab 05 (2 GB vs 4 GB files, different times); the conclusion doesn’t change. And we didn’t measure JetBackup with another cipher: what applies is the path (rsync over OpenSSH with the default cipher), not a product comparison.
Want to see Salvo on your server?Join the beta waitlist. We’ll let you know when there’s a spot.