Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: iptables latency evaluation
Special Forums Cybersecurity iptables latency evaluation Post 302568808 by Slaughterman on Friday 28th of October 2011 09:32:44 AM
Old 10-28-2011
iptables latency evaluation
Hello guys,

I'm actually working on my master thesis which has for subject the evaluation of virtual firewall in a cloud environment. To do so, I installed my own cloud using OpenNebula (as a frontend) and Xen (as a Node) on two different machines. The Xen machine is my virtual firewall thanks to iptables.

I am running a number of different performance tests over the xen machine to evaluate the performance of iptables. One of this test, would be the latency time introduced by the processing of the packet in iptables; and this is where I'm having troubles testing it.

Here are the different ideas I had so far, and their problems:
- ICMP Timestamp pinging. An ICMP Timestamp reply contains three timestamps: originate timestamp which is the time the sender last touched the message, receive timestamp which is the time the receiver first touched the message, and transmit timestamp which is the time the receiver last touched the message before sending it back. By subtracting the transmit timestamp by the receive timestamp, we get the processing latency of the packet. The problem is the time is in milliseconds which is no precise enough as the latency (at least when a very little number of rules are active in iptables) is lower than 1ms.
- Normal ping ran two times with the firewall on, and then off. The process time is the subtraction between this two times, divided buy 2 (because of round-trip latency) A little more precise has it is in microsecond, but still not enough (nanoseconds would be good). And I fear all this calculation adds too much approximation anyway...
- Wireshark timestamp calculation: sucks totally as wireshark capture the packets before they enter iptables
- Normal ping one time. Displaying the latency as round-trip latency. I won't get the processing latency, but I will still be able to display in a graph the effect of rules and throughput level on the overall latency of a connection going through the firewall. That's my "best" plan so far, but it sucks because it's off the original idea which is measuring the firewall latency only.

Do you guys have any comments on my ideas, or even better a solution to accurately measure firewall latency ?

Cheers,

Clement
 

5 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

cp command evaluation

Hi all! I'm writting one script to copy a file in various folders, but there are 2 things to validate. First that the folder where i'll be cpying exists, and second that i have permissions to copy the file in it. so far i have found the way to validate the folder exists, but when trying to... (6 Replies)
Discussion started by: feliperivera
6 Replies

2. UNIX for Advanced & Expert Users

Determining typing latency

Hi all, When I use an editor (vi) that is spawned in a remote server, visually I could see the latency between typing a character/word and being displayed on the terminal. I could see this visually but how do I get a metric on this or how to quantify this? As expected, when I type in a editor... (6 Replies)
Discussion started by: matrixmadhan
6 Replies

3. AIX

Latency Test

Hi every one, we have a set up in solaris 8 and 9 and running many cshell scripts.. we are migrate to AIX . Now, i want to know the latency difference between two boxes(Solaris and AIX). Kindly help me to , how to do Latency test.. (0 Replies)
Discussion started by: Madhu Siddula
0 Replies

4. Solaris

Latency Test

Hi every one, we have a set up in solaris 8 and 9 and running many cshell scripts.. we are migrate to AIX . Now, i want to know the latency difference between two boxes(Solaris and AIX). Kindly help me to , how to do Latency test.. (2 Replies)
Discussion started by: Madhu Siddula
2 Replies

5. Red Hat

Memory release latency issue

I have an application that routinely alloc() and realloc() gigabyte blocks of memory for image processing applications; specifically performing rotations of huge images, or creating/ deleting huge image buffers to contain multiple images. Immediately upon completion of an operation I call free() to... (9 Replies)
Discussion started by: imagtek
9 Replies

LEARN ABOUT OSX

latency

LATENCY(1)						    BSD General Commands Manual 						LATENCY(1)

NAME

     latency -- monitors scheduling and interrupt latency

SYNOPSIS

     latency [-p] [-h] [-m] [-st threshold] [-it threshold] [-c code_file] [-l log_file] [-R raw_file] [-n kernel]

DESCRIPTION

     The latency utility provides scheduling and interrupt-latency statistics.	Due to the kernel tracing facility it uses to operate, the command
     requires root privileges.

     The arguments are as follows:

     -c code_file
	     When the -c option is specified, it takes a path to a code file that contains the mappings for the system calls.  This option over-
	     rides the default location of the system call code file, which is found in /usr/share/misc/trace.codes.

     -h      Display high resolution interrupt latencies and write them to latencies.csv (truncate existing file) upon exit.

     -m      Display per-CPU interrupt latency statistics.

     -it threshold
	     Set the interrupt latency threshold, expressed in microseconds.  If the latency exceeds this value, and a log file has been speci-
	     fied, a record of what occurred during this time is recorded.

     -l log_file
	     Specifies a log file that is written to when either the interrupt or scheduling latency is exceeded.

     -n kernel
	     By default, latency acts on the default /mach_kernel.  This option allows you to specify an alternate booted kernel.

     -p priority
	     Specifies the priority level to observe scheduler latencies for.

     -st threshold
	     Set the scheduler latency threshold in microseconds.  If latency exceeds this, and a log file has been specified, a record of what
	     occurred during this time is recorded.

     -R raw_file
	     Specifies a raw trace file to use as input.

     The data columns displayed are as follows:

     SCHEDULER		       The number of context switches that fall within the described delay.

     INTERRUPTS 	       The number of interrupts that fall within the described delay.

     The latency utility is also SIGWINCH savvy, so adjusting your window geometry will change the list of delay values displayed.

SAMPLE USAGE

     latency -p 97 -st 20000 -it 1000 -l /var/tmp/latency.log

     The latency utility will watch threads with priority 97 for scheduling latencies.	The threshold for the scheduler is set to 20000 microsec-
     onds.  The threshold for interrupts is set to 1000 microseconds.  Latencies that exceed these thresholds will be logged in
     /var/tmp/latency.log.

SEE ALSO

     fs_usage(1), sc_usage(1), top(1)

Mac OS X							  March 28, 2000							  Mac OS X
All times are GMT -4. The time now is 01:26 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy