Performance Evaluation of netfilter: A Study on the Performance Loss When Using netfilter as a Firewall (1502.05487v1)

Abstract: Since GNU/Linux became a popular operating system on computer network routers, its packet routing mechanisms attracted more interest. This does not only concern 'big' Linux servers acting as a router but more and more small and medium network access devices, such as DSL or cable access devices. Although there are a lot of documents dealing with high performance routing with GNU/Linux, only a few offer experimental results to prove the given advices. This study evaluates the throughput performance of Linux' routing subsystem netfilter under various conditions like different data transport protocols in combination with different IP address families and transmission strategies. Those conditions were evaluated with two different types of netfilter rules for a high number in the rule tables. In addition to this, our experiments allowed us to evaluate two prominent client connection handling techniques (threads and the epoll() facility). The evaluation of the 1.260 different combinations of our test parameters shows a nearly linear but small throughput loss with the number of rules which is independant from the transport protocol and framesize. However, this evaluation identifies another issue concerning the throughput loss when it comes to the address family, i.e. IPv4 and IPv6.