Re: Firewalls that generate new packets..

["Marcus J. Ranum" <mjr () ranum com>]

Dave Piscitello wrote:
> I really would like to see a thorough analysis of the performance of an application layer policy enforcement using 
> strictly stateful inspection techniques versus the same policy enforced using strictly proxy techniques.

It's pointless, Dave. "stateful inspection firewalls" ought to consistently
perform about as fast as routers. Because that's pretty much what they
are. Something that does any layer-7 analysis will always be slower
than something that does nothing more than table lookup and a
sequence number check.

mjr. 

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards