Re: RE: High Speed Firewalls

[Crispin Cowan <crispin () wirex com>]

David Newman wrote:

> > The "headers" stuff degrades throughput.
>
> Right. So you agree, then, that even in theory it's not possible to move 100
> Mbits of *user data* (e.g., a 12.5-Mbyte file) in 1 second over fast
> Ethernet?

Agreed.


> >  The other stuff
> > degrades latency.
>
> They also degrade throughput. SYNs, FINs, and 3-way handshakes puts bits on
> the wire too, and get counted in a throughput measurement (see RFC 1242). If
> you're speaking of application-layer throughput (e.g., what wu-ftpd reports)
> the overhead doesn't get counted -- but that measurement will never report
> moving 12.5 Mbytes/second unless the implementation is seriously broken.

True.  I had forgotten about the SYN & ACK traffic on a simplex line.

So now there's lots of reasons why application layer bandwidth never can reach
raw "line-speed" bandwidth.  However, none of those reasons have anything to do
with a firewall being in the way.  I continue to assert that for whatever the
upper bound is on network throughput, it is possible to put a big badass
firewall in the way, and with sufficient memory and computes in the firewall,
run that puppy at the same *throughput* as the un-mediated line.

Consider an analogy to the New Jersey Turnpike:

   * cars are like packets
   * latency is the transit time from NYC to DC
   * throughput is the number of cars per hour past a given point
   * toll booths (like firewalls) do inspection, and definitely affect latency
   * if the power of the toll booth (how many booths you have) is insufficient,
     then they cause a backlog, cars/packets queue up, and throughput degrades
   * if the power of the toll both is sufficient, then all cars/packets get
     their own booth upon arrival, and throughput is not affected

Continuing the analogy, if you were to do something like encapsulation or
tunneling (wrapping packets inside packets, a la IPSec) then you have added
headers, making the payload packets bigger.  This is as if you made all the
cars 45 feet long, degrading the number of cars that can pass a given point per
hour (because they can't pack as close together).  *That* will degrade
throughput, no matter how much compute power you put in the firewall.

Crispin
-----
Crispin Cowan, CTO, WireX Communications, Inc.    http://wirex.com
Free Hardened Linux Distribution:                 http://immunix.org
                  JOBS!  http://immunix.org/jobs.html