RE: Firewall performance

["Choi, Byoung" <bchoi () visa com>]

don't deal much with firewalls, but from my experience mucking with IDS
(intrusion detection system - which scans all traffic it sees and processes
them to determine if it's something nasty, thus somewhat similar to firewall
which receives the traffic, analyze it, and pass it on or discard), the
major factors are:

CPU speed
OS protocol stack efficiency
degree of complexity of the routing/filtering rules


memory is important only if you don't have enough - i.e., if it has to go to
the swap device, then you don't have enough.  otoh, if you don't go to swap,
no point in adding more memory - won't help you.

the IDS boxes i messed with are ultrasparc solaris boxes monitoring fast
ethernet segments, and if the traffic go above (if i remember correctly)
5000 packets/s, it starts dropping packets (the limit would go much higher
if the monitoring rules are less complicated).  similar set up with NT on
intel is even worse.

generally, stripped down UNIX OS seems more efficient than NT due to their
protocol stack being better trimmed over the years, and you can get rid of a
lot of components not used (GUI, etc.).  also better stability.  nt in intel
is still bit cheaper, though, but remote management for nt is also very
immature.

because CPU was the bottleneck, it's ovious that complexity of
filtering/routing rules become a major factor.

(btw, sorry for being ignorant, but are there fw products that uses SMP
architecture efficiently?  if so, this whole comparison is nonsense, cuz the
IDS box was incapable of making use of multiple CPUs, and thus CPU being the
bottleneck)

also, performance may vary by how you measure - raw traffic load (Mbs) or
packets/second (ps).  becasue for the IDS the individual packets is the
basic unit of data to be examined, ps was more useful gauge for us - of
course, you can make the packet only so small, thus bandwidth (Mbs) of the
medium obviously put a limit on the range of ps for the medium.

didn't specifically compare the bus performance (S-bus vs. PCI), but from
looking at the spec and looking at where the bottleneck lies, my guess would
be that the performances are at similar level.
 
well, this dribble is speculation based on the assumption that IDS & fw
perform similar processing tasks, so... y'know.

8-)

b-





> ----------
> From:         Sandy Green[SMTP:sand232 () yahoo com]
> Reply To:     Sandy Green
> Sent:         Tuesday, June 22, 1999 11:41 AM
> To:   firewall-wizards () nfr net
> Subject:      Re: Firewall performance
>
> Thanks to all those who responded. But actaully
> that does not answer my query. 
> There is a lab report on the checkpoint site about the 
> solaris vs NT performance. 
> fine.... but actaully there are other important factors
> like PCI bus speed of the computer as well, CPU 
> speed ,memory. 
> The point is that even if the CPU speed is a 500 MHZ pentium and 
> memory is 10 MB , that does not help improve the performance.
> what the labs do is get a machine from DELL/COMPAQ latest model as
> shipped by them and perform the tests on them without tailoring the
> RAM or PCI speed.
> I have done some tests on a server with 500 MB of RAM ! and there
> was no significant improvement. I thought that this list would have
> expereinced such issues in their environments. But unluckily for 
> me I have not got any response from any of the list members.
> But I would keep persisting....
>
> thanks to all. and please do email me.
> sandy
>
> Date: Thu, 17 Jun 1999 17:58:46 -0700 (PDT)
> From: Sandy Green <sand232 () yahoo com>
> Subject: Security conference NETSEC 99
>
> Dear list members,
>
> I needed to get some sort of feedback about the 
> recently held Security conference NETSEC 99.
> All the lucky ones who atteneded this conference
> would have certainily benefited from it. But for some
> reason(s) I could not make it. I would greatly appreciate
> if some of you could share your experiences and 
> learning with me. 
>
> second. This is about the firewall performance.
> In my mind these would be the factors for the 
> bastion host performance ( processing the number
> of packets and taking a decision )
> CPU speed, PCI bus speed, Memory,..., and of 
> course the WAN link connectivity speed... any more
>
> all thes factors have in turn a direct bearing on each
> other... just like security as strong as the weakesk
> link, similarly the processing speed (of the firewall)
> would be as fast as the slowest parameter( CPU
> speed, WAN/LAN connectivity speed, PCI bus speed...)
> Please let me know your views or could point me to
> resources on the web.
>
> Thanks
> sandy
> _________________________________________________________
> Do You Yahoo!?
> Get your free @yahoo.com address at http://mail.yahoo.com