RE: Firewall performance

[Robert Graham <robert_david_graham () yahoo com>]

> the IDS boxes i messed with are ultrasparc solaris boxes monitoring fast
> ethernet segments, and if the traffic go above (if i remember correctly)
> 5000 packets/s, it starts dropping packets (the limit would go much higher
> if the monitoring rules are less complicated).  similar set up with NT on
> intel is even worse.

Sounds like you have some pretty ancient hardware. A dual-CPU 450 WinNT
box should easily be able to handle 100,000 packets/second. (At least
my own machine runs an IDS even faster than that).

> generally, stripped down UNIX OS seems more efficient than NT due to ....

In general, a stripped down UNIX ALWAYS outperforms WinNT. Especially
if you can choose the UNIX system that is already optimized for
your needs (i.e. BSD variants handle network traffic better than
SysV variants). However, the more you strip things down, the more you
reach the point where you have no OS. For example, you can easily
write an IDS under WinNT that outperforms any UNIX variant
by simply writing a driver for a particular card. In other words,
you have lifted WinNT up and put your own application underneath
it. I worked on a project that did that for RMONv2. Basically, it
had a little timer that would guarantee 10% of the CPU for the OS,
but reserved 90% of the CPU for its own use. (On the other hand,
I hated having to respond to people saying that it would still be
a lot faster on UNIX. They couldn't quite wrap their minds
around the concept of Windows running on our own app, and not
the other way around).

> but remote management for nt is also very immature.

Remote management for WinNT is extremely bad. On UNIX, you can
open a shell prompt in numerous ways (ssh, or even just a serial
connection to a terminal server) and do all your management. 
However, WinNT has been architected with friendly GUIs. 
Yes, all the GUIs Microsoft ships allows
easy remote administration, but it is terribly unsecure,
and you never get the tweakability that true geeks love.

Rob.




_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com