Sponsored Content
Full Discussion: iptables latency evaluation
Special Forums Cybersecurity iptables latency evaluation Post 302568808 by Slaughterman on Friday 28th of October 2011 09:32:44 AM
Old 10-28-2011
iptables latency evaluation

Hello guys,

I'm actually working on my master thesis which has for subject the evaluation of virtual firewall in a cloud environment. To do so, I installed my own cloud using OpenNebula (as a frontend) and Xen (as a Node) on two different machines. The Xen machine is my virtual firewall thanks to iptables.

I am running a number of different performance tests over the xen machine to evaluate the performance of iptables. One of this test, would be the latency time introduced by the processing of the packet in iptables; and this is where I'm having troubles testing it.

Here are the different ideas I had so far, and their problems:
- ICMP Timestamp pinging. An ICMP Timestamp reply contains three timestamps: originate timestamp which is the time the sender last touched the message, receive timestamp which is the time the receiver first touched the message, and transmit timestamp which is the time the receiver last touched the message before sending it back. By subtracting the transmit timestamp by the receive timestamp, we get the processing latency of the packet. The problem is the time is in milliseconds which is no precise enough as the latency (at least when a very little number of rules are active in iptables) is lower than 1ms.
- Normal ping ran two times with the firewall on, and then off. The process time is the subtraction between this two times, divided buy 2 (because of round-trip latency) A little more precise has it is in microsecond, but still not enough (nanoseconds would be good). And I fear all this calculation adds too much approximation anyway...
- Wireshark timestamp calculation: sucks totally as wireshark capture the packets before they enter iptables
- Normal ping one time. Displaying the latency as round-trip latency. I won't get the processing latency, but I will still be able to display in a graph the effect of rules and throughput level on the overall latency of a connection going through the firewall. That's my "best" plan so far, but it sucks because it's off the original idea which is measuring the firewall latency only.

Do you guys have any comments on my ideas, or even better a solution to accurately measure firewall latency ?

Cheers,

Clement
 

5 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

cp command evaluation

Hi all! I'm writting one script to copy a file in various folders, but there are 2 things to validate. First that the folder where i'll be cpying exists, and second that i have permissions to copy the file in it. so far i have found the way to validate the folder exists, but when trying to... (6 Replies)
Discussion started by: feliperivera
6 Replies

2. UNIX for Advanced & Expert Users

Determining typing latency

Hi all, When I use an editor (vi) that is spawned in a remote server, visually I could see the latency between typing a character/word and being displayed on the terminal. I could see this visually but how do I get a metric on this or how to quantify this? As expected, when I type in a editor... (6 Replies)
Discussion started by: matrixmadhan
6 Replies

3. AIX

Latency Test

Hi every one, we have a set up in solaris 8 and 9 and running many cshell scripts.. we are migrate to AIX . Now, i want to know the latency difference between two boxes(Solaris and AIX). Kindly help me to , how to do Latency test.. (0 Replies)
Discussion started by: Madhu Siddula
0 Replies

4. Solaris

Latency Test

Hi every one, we have a set up in solaris 8 and 9 and running many cshell scripts.. we are migrate to AIX . Now, i want to know the latency difference between two boxes(Solaris and AIX). Kindly help me to , how to do Latency test.. (2 Replies)
Discussion started by: Madhu Siddula
2 Replies

5. Red Hat

Memory release latency issue

I have an application that routinely alloc() and realloc() gigabyte blocks of memory for image processing applications; specifically performing rotations of huge images, or creating/ deleting huge image buffers to contain multiple images. Immediately upon completion of an operation I call free() to... (9 Replies)
Discussion started by: imagtek
9 Replies
lgrp_latency(3LGRP)					 Locality Group Library Functions				       lgrp_latency(3LGRP)

NAME
lgrp_latency, lgrp_latency_cookie - get latency between two lgroups SYNOPSIS
cc [ flag... ] file... -llgrp [ library... ] #include <sys/lgrp_user.h> int lgrp_latency_cookie(lgrp_cookie_t cookie, lgrp_id_t from, lgrp_id_t to, lgrp_lat_between_t between); int lgrp_latency(lgrp_id_t from, lgrp_id_t to); DESCRIPTION
The lgrp_latency_cookie() function takes a cookie representing a snapshot of the lgroup hierarchy obtained from lgrp_init(3LGRP) and returns the latency value between a hardware resource in the from lgroup to a hardware resource in the to lgroup. If from is the same lgroup as to, the latency value within that lgroup is returned. The between argument should be set to the following value to specify between which hardware resources the latency should be measured: LGRP_LAT_CPU_TO_MEM /* latency from CPU to memory */ The latency value is defined by the operating system and is platform-specific. It can be used only for relative comparison of lgroups on the running system. It does not necessarily represent the actual latency between hardware devices, and it might not be applicable across platforms. The lgrp_latency() function is similiar to the lgrp_latency_cookie() function, but returns the latency between the given lgroups at the given instant in time. Since lgroups can be freed and reallocated, this function might not be able to provide a consistent answer across calls. For that reason, the lgrp_latency_cookie() function should be used in its place. RETURN VALUES
Upon successful completion, the latency value is returned. Otherwise -1 is returned and errno is set to indicate the error. ERRORS
The lgrp_latency_cookie() and lgrp_latency() functions will fail if: EINVAL The specified cookie, lgroup ID, or value given for the between argument is not valid. ESRCH The specified lgroup ID was not found, the from lgroup does not contain any CPUs, or the to lgroup does not have any memory. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |Interface Stability |Evolving | +-----------------------------+-----------------------------+ |MT-Level |MT-Safe | +-----------------------------+-----------------------------+ SEE ALSO
lgrp_init(3LGRP), lgrp_parents(3LGRP), lgrp_children(3LGRP), liblgrp(3LIB), attributes(5) SunOS 5.11 26 Jan 2005 lgrp_latency(3LGRP)
All times are GMT -4. The time now is 07:23 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy