该研究关注Linux主机上iptables防火墙的性能影响和敏感性。通过深入分析Linux TCP/IP堆栈的每一层，研究人员在两种场景下测试了防火墙：一是测量单个数据包的路径和延迟；二是观察不同传输速率下多数据包的延迟。结果显示，防火墙性能受规则数量、过滤类型和传输速率的影响。规则数量增加时，延迟线性增长；而数据包传输速率提高，延迟反而下降。对于64字节载荷的数据包，从0到100条规则，防火墙产生的额外开销百分比范围为6%到75%。
Abstract
Firewalls are one of the most commonly used security systems to protect networks and hosts. Most researchers have focused on analyzing the latency and throughput of router firewalls. Different from this approach, this research focuses on studying the performance impact and the sensitivity of the Linux firewall (iptables) for a single host. In order to be able to measure the performance and the sensitivity of the firewall, we designed and instrumented each layer of the Linux TCP/IP stack. This instrumentation was used to test the host’s firewall under two scenarios: In the first scenario, we captured the path and the latency of one single packet; in the second scenario, we captured the latency of multiple packets sent to the host at various transmission rates. Our measurement results indicate that the firewall is sensitive to the number of rules, the type of filtering, and the transmission rate. The results of our first scenario demonstrate that for each type of filtering, latency increases linearly as the number of rules increase. Furthermore, the second test scenario shows that latency decreases as the packet transmission rate increases. The results also show that the percentage overhead generated by a firewall when a single packet of 64 bytes of payload travels the TCP/IP stack, for a rule-set of zero and 100 rules, ranges from 6 % to up to 75%, respectively. 1
CiteSeerX — Abstract Performance analysis of the Linux firewall in a host
扫一扫
1339
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
