Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 22 Sep 1998 23:50:52 +1000 (EST)
From:      Darren Reed <avalon@coombs.anu.edu.au>
To:        liam@tiora.net (Liam Slusser)
Cc:        tomaz.borstnar@over.net, freebsd-security@FreeBSD.ORG
Subject:   Re: performance comparision of ipfilter and ipfw
Message-ID:  <199809221352.GAA05368@hub.freebsd.org>
In-Reply-To: <Pine.BSF.3.96.980922003608.7110B-100000@orbital.tiora.net> from "Liam Slusser" at Sep 22, 98 00:37:04 am

next in thread | previous in thread | raw e-mail | index | archive | help
> On Tue, 22 Sep 1998, Tomaz Borstnar wrote:
> 
> > Hello!
> > 
> > 	Anyone did testing on performance of IPFW and IPFilter? From feature list
> > it looks like IPfilter has better interface and more features, but what
> > about perfomance? Also what kind of machine would you suggest for firewall?
> > As fast as possible CPU, 256MB RAM and plenty of disk?
> > 
> > Tomaz
> > 
> > ----
> > Tomaz Borstnar <tomaz.borstnar@over.net>
> > "Love is the answer to the final question you ask" - Unknown

I missed the original email (presumably posted elsewhere) but I'll respond
re. IP Filter.

In testing I did some time ago now, on a Sun Sparc2 (~486dx2-66 in speed).
With 400 rules, 400 packets took around 11 minutes to be processed 1000
times which comes out at around 4us for 1 packet to be processed by 1 rule.
That is *JUST* for packet filtering, no state stuff, no NAT, no logging.

Quite some time ago I designed IP Filter to provide extensive coverage for
TCP/IP filtering, probably more than most people will need but attempted
to do it in a way that has no doubt increased the `cost' of doing 1 simple
rule but has also brought down the `cost' of doing complex ones.

As others have mentioned, the choice of network card is important - choose
a PCI one which can do bus mastering (well, that's moot really as that
still depends on FreeBSD support :).  Somewhere between 32MB and 128MB
of RAM is good - 256MB is just a waste.

Darren

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199809221352.GAA05368>