Re: [fw-wiz] Evaluating Firewall

From: Carson Gaspar (carson_at_taltos.org)
Date: 05/06/03

  • Next message: Zahid Ahmad Khan: "[fw-wiz] Traffic Monitoring" 
    To: firewall-wizards@honor.icsalabs.com
Date: Mon, 05 May 2003 18:49:07 -0400

    If you are going to do performance testing as part of the evaluation, here
    are some criteria to look at, based on my experience of vendor benchmark
    ... ummm ... "optimization". It was educational to watch the vendors squirm
    in the last RFP I did, when they were forced to report numbers based on
    these criteria. It's amazing how different they were than the initial
    numbers we were given... ;-)

    - TCP Connections / sec vs. number of rules

    If any state is being kept, only the initial packet / connection traverses
    the rule base. TCP has more state setup work than UDP, in many
    implementations.

    Make sure the matching rule is _last_. If there is rule base optimization
    going on, you have to be very careful about your test conditions. So don't
    let it be 10,000 UDP rules followed by a TCP rule, if it branches on
    protocol.

    - TCP Packets / sec vs. packet size

    This will illuminate the packet rate limitations, as well as the bit rate
    limitations (which are frequently 2 different limits - firewalls rarely can
    keep up at their bit rate limit with 64 byte packets)

    Make sure _real_ packets are being used (so TCP sequence numbers are being
    incremented properly, etc.), and that they are being passed - not dropped
    to to rule set or overloading. These numbers should be for 0% packet loss.

    - TCP Packets / sec vs. # of established connections (same caveats as above)

    Most firewalls have to do a connection lookup for established sessions.
    Good ones will do so with some algorithm that is O(log n) (or so) instead
    of O(n).

    - Behavior on saturation

    How does the firewall behave once you've gone beyond its capacity? Does it
    gracefully degrade, or fall off a cliff? Do existing connections or old
    connections get priority? 

    -- 
Carson Gaspar
_______________________________________________
firewall-wizards mailing list
firewall-wizards@honor.icsalabs.com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
  • Next message: Zahid Ahmad Khan: "[fw-wiz] Traffic Monitoring"

    Relevant Pages

    • RE: Ambiguities in TCP/IP - firewall bypassing
      ... The flag combinations with that post relate to Linux 2.2.x and Windows ... If the firewall is just a simple packet filter that blocks incoming ... For example, sending a TCP ... design of firewalls and packet filters since an improper implementation ...
      (Bugtraq)
    • Re: iptables strangeness
      ... >>>And why is the SYN ACK packet not ESTABLISHED? ... >>>Nimda infected host made a sequence of connections. ... > the description of the TCP protocol and in iptables. ... NEW is equivalent to the initial TCP SYN request, ...
      (comp.os.linux.security)
    • Re: can I use keep-state for icmp rules?
      ... if you're like me and allow incoming established connections to any port, ... unless he connects withough sending a "connect" packet first - ie ... >> the impression that ipfwactually tracks the state of TCP ... > internal tcp ports that might not normally have external access available? ...
      (FreeBSD-Security)
    • Re: How does outpost compair to ZAP?
      ... | There are two diffrent kinds of outgoing protection. ... | scans incoming and outgoing packets or connections for attacks and blocks ... Couple these IDS features with a packet filtering engine and you've ... Indeed, all software firewalls are ...
      (comp.security.firewalls)
    • alt.2600 FAQ Revision .014 (2/4)
      ... One type of firewall is the packet filtering firewall. ... Dropping packets instead of rejecting them greatly increases the time required to scan your network. ... Port scanning UDP ports is much slower than port scanning TCP ports. ... Chartreuse Use the electricity from your phone line Cheese Connect two phones to create a diverter Chrome Manipulate Traffic Signals by Remote Control ...
      (alt.2600)