iptables latency evaluation Post: 302568808

Sponsored Content

Special Forums Cybersecurity iptables latency evaluation Post 302568808 by Slaughterman on Friday 28th of October 2011 09:32:44 AM

10-28-2011

Registered User

iptables latency evaluation

Hello guys,

I'm actually working on my master thesis which has for subject the evaluation of virtual firewall in a cloud environment. To do so, I installed my own cloud using OpenNebula (as a frontend) and Xen (as a Node) on two different machines. The Xen machine is my virtual firewall thanks to iptables.

I am running a number of different performance tests over the xen machine to evaluate the performance of iptables. One of this test, would be the latency time introduced by the processing of the packet in iptables; and this is where I'm having troubles testing it.

Here are the different ideas I had so far, and their problems:
- ICMP Timestamp pinging. An ICMP Timestamp reply contains three timestamps: originate timestamp which is the time the sender last touched the message, receive timestamp which is the time the receiver first touched the message, and transmit timestamp which is the time the receiver last touched the message before sending it back. By subtracting the transmit timestamp by the receive timestamp, we get the processing latency of the packet. The problem is the time is in milliseconds which is no precise enough as the latency (at least when a very little number of rules are active in iptables) is lower than 1ms.
- Normal ping ran two times with the firewall on, and then off. The process time is the subtraction between this two times, divided buy 2 (because of round-trip latency) A little more precise has it is in microsecond, but still not enough (nanoseconds would be good). And I fear all this calculation adds too much approximation anyway...
- Wireshark timestamp calculation: sucks totally as wireshark capture the packets before they enter iptables
- Normal ping one time. Displaying the latency as round-trip latency. I won't get the processing latency, but I will still be able to display in a graph the effect of rules and throughput level on the overall latency of a connection going through the firewall. That's my "best" plan so far, but it sucks because it's off the original idea which is measuring the firewall latency only.

Do you guys have any comments on my ideas, or even better a solution to accurately measure firewall latency ?

Cheers,

Clement

Slaughterman

View Public Profile for Slaughterman

Find all posts by Slaughterman

5 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

cp command evaluation

Hi all! I'm writting one script to copy a file in various folders, but there are 2 things to validate. First that the folder where i'll be cpying exists, and second that i have permissions to copy the file in it. so far i have found the way to validate the folder exists, but when trying to...

2. UNIX for Advanced & Expert Users

Determining typing latency

Hi all, When I use an editor (vi) that is spawned in a remote server, visually I could see the latency between typing a character/word and being displayed on the terminal. I could see this visually but how do I get a metric on this or how to quantify this? As expected, when I type in a editor...

3. AIX

Latency Test

Hi every one, we have a set up in solaris 8 and 9 and running many cshell scripts.. we are migrate to AIX . Now, i want to know the latency difference between two boxes(Solaris and AIX). Kindly help me to , how to do Latency test..

4. Solaris

Latency Test

5. Red Hat

Memory release latency issue

I have an application that routinely alloc() and realloc() gigabyte blocks of memory for image processing applications; specifically performing rotations of huge images, or creating/ deleting huge image buffers to contain multiple images. Immediately upon completion of an operation I call free() to...

LEARN ABOUT DEBIAN

pgaevaluate

PGAEvaluate(1)							      PGAPack							    PGAEvaluate(1)

NAME

       PGAEvaluate - Calls a user-specified function to return an evaluation of each string in the population.

DESCRIPTION

       The  user-specified function is only called if the string has been changed (e.g., by crossover or mutation) or the user has explicitly sig-
       naled the string's evaluation is out-of-date by a call to PGASetEvaluationUpToDateFlag().

INPUT PARAMETERS

       ctx    - context variable
       pop    - symbolic constant of the population to be evaluated
       f      - a pointer to a function to evaluate a string.  This function will be called once for each string in population pop  that  requires
	      evaluation.   This  function must return a double (the evaluation function value) and must fit the prototype double f(PGAContext *c,
	      int p, int pop);
       comm   - an MPI communicator

OUTPUT PARAMETERS

       none

SYNOPSIS

       #include "pgapack.h"
       void  PGAEvaluate(ctx, pop, , comm)
       PGAContext *ctx
       int pop
       double (*f)(PGAContext *, int, int)
       MPI_Comm comm

LOCATION

       parallel.c

EXAMPLE

       Example:
       Evaluate all strings in population PGA_NEWPOP using the user-defined
       evaluation function Energy.

       double Energy(PGAContext *ctx, int p, int pop) {
       :
       };

       PGAContext *ctx;
       :
       PGAEvaluate(ctx, PGA_NEWPOP, Energy, MPI_COMM_WORLD);

								     05/01/95							    PGAEvaluate(1)

5 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

cp command evaluation

Discussion started by: feliperivera

2. UNIX for Advanced & Expert Users

Determining typing latency

Discussion started by: matrixmadhan

3. AIX

Latency Test

Discussion started by: Madhu Siddula

4. Solaris

Latency Test

Discussion started by: Madhu Siddula

5. Red Hat

Memory release latency issue

Discussion started by: imagtek

LEARN ABOUT DEBIAN

pgaevaluate