Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: iptables latency evaluation
Special Forums Cybersecurity iptables latency evaluation Post 302568808 by Slaughterman on Friday 28th of October 2011 09:32:44 AM
Old 10-28-2011
iptables latency evaluation
Hello guys,

I'm actually working on my master thesis which has for subject the evaluation of virtual firewall in a cloud environment. To do so, I installed my own cloud using OpenNebula (as a frontend) and Xen (as a Node) on two different machines. The Xen machine is my virtual firewall thanks to iptables.

I am running a number of different performance tests over the xen machine to evaluate the performance of iptables. One of this test, would be the latency time introduced by the processing of the packet in iptables; and this is where I'm having troubles testing it.

Here are the different ideas I had so far, and their problems:
- ICMP Timestamp pinging. An ICMP Timestamp reply contains three timestamps: originate timestamp which is the time the sender last touched the message, receive timestamp which is the time the receiver first touched the message, and transmit timestamp which is the time the receiver last touched the message before sending it back. By subtracting the transmit timestamp by the receive timestamp, we get the processing latency of the packet. The problem is the time is in milliseconds which is no precise enough as the latency (at least when a very little number of rules are active in iptables) is lower than 1ms.
- Normal ping ran two times with the firewall on, and then off. The process time is the subtraction between this two times, divided buy 2 (because of round-trip latency) A little more precise has it is in microsecond, but still not enough (nanoseconds would be good). And I fear all this calculation adds too much approximation anyway...
- Wireshark timestamp calculation: sucks totally as wireshark capture the packets before they enter iptables
- Normal ping one time. Displaying the latency as round-trip latency. I won't get the processing latency, but I will still be able to display in a graph the effect of rules and throughput level on the overall latency of a connection going through the firewall. That's my "best" plan so far, but it sucks because it's off the original idea which is measuring the firewall latency only.

Do you guys have any comments on my ideas, or even better a solution to accurately measure firewall latency ?

Cheers,

Clement
 

5 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

cp command evaluation

Hi all! I'm writting one script to copy a file in various folders, but there are 2 things to validate. First that the folder where i'll be cpying exists, and second that i have permissions to copy the file in it. so far i have found the way to validate the folder exists, but when trying to... (6 Replies)
Discussion started by: feliperivera
6 Replies

2. UNIX for Advanced & Expert Users

Determining typing latency

Hi all, When I use an editor (vi) that is spawned in a remote server, visually I could see the latency between typing a character/word and being displayed on the terminal. I could see this visually but how do I get a metric on this or how to quantify this? As expected, when I type in a editor... (6 Replies)
Discussion started by: matrixmadhan
6 Replies

3. AIX

Latency Test

Hi every one, we have a set up in solaris 8 and 9 and running many cshell scripts.. we are migrate to AIX . Now, i want to know the latency difference between two boxes(Solaris and AIX). Kindly help me to , how to do Latency test.. (0 Replies)
Discussion started by: Madhu Siddula
0 Replies

4. Solaris

Latency Test

Hi every one, we have a set up in solaris 8 and 9 and running many cshell scripts.. we are migrate to AIX . Now, i want to know the latency difference between two boxes(Solaris and AIX). Kindly help me to , how to do Latency test.. (2 Replies)
Discussion started by: Madhu Siddula
2 Replies

5. Red Hat

Memory release latency issue

I have an application that routinely alloc() and realloc() gigabyte blocks of memory for image processing applications; specifically performing rotations of huge images, or creating/ deleting huge image buffers to contain multiple images. Immediately upon completion of an operation I call free() to... (9 Replies)
Discussion started by: imagtek
9 Replies

LEARN ABOUT DEBIAN

xapi

XCP-XAPI(1)							   User Commands						       XCP-XAPI(1)

NAME

       xcp-xapi - XCP's XenAPI server

DESCRIPTION

       The  Xen  Cloud	Platform  (XCP)  is an open source enterprise-ready server virtualization and cloud computing platform, with support for a
       range of guest operating systems, Linux network and storage support.

       XCP addresses the needs of cloud providers, hosting services and data centers by combining the isolation and multitenancy  capabilities	of
       the  Xen  hypervisor  with enhanced security, storage and network virtualization technologies to offer a rich set of virtual infrastructure
       cloud services. The platform also address user requirements for security, availability, performance and isolation across both  private  and
       public clouds.

       XCP  consolidates  server  workloads, enables savings in power, cooling, and management costs and thus contributing to environmentally sus-
       tainable computing, an increased ability to adapt to ever-changing IT environments, an optimized use of existing hardware, and an  improved
       level of IT reliability.

       This  is  the XenAPI server, which provides the control plane for XCP hosts and resource pools. To manage the XenAPI server, you should use
       either the XML-RPC based API, the xe command line tool, or a graphical user interface such as OpenXenManager.

SYNOPSIS

       -daemon run as a daemon in the background

       -config set config file to use

       -logconfig set log config file to use

       -writereadyfile touch specified file when xapi is ready to accept requests

       -writeinitcomplete touch specified file when xapi init process is complete

       -nowatchdog turn watchdog off, avoiding initial fork

       -setdom0mem (ignored)

       -dom0memgradient (ignored)

       -dom0memintercept (ignored)

       -onsystemboot indicates that this server start is the first since the host rebooted

       -noevents turn event thread off for debugging -leaves crashed guests undestroyed

       -dummydata populate with dummy data for demo/debugging purposes

       -version show version of the binary

       -help  Display this list of options

       --help Display this list of options

SEE ALSO

       The full documentation for xcp-xapi is maintained as a Texinfo manual.  If the info and xcp-xapi programs are properly  installed  at  your
       site, the command

	      info xcp-xapi

       should give you access to the complete manual.

xcp-xapi version 1.3						   December 2011						       XCP-XAPI(1)
All times are GMT -4. The time now is 09:34 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy