Performance Evaluation of netfilter: A Study on the Performance Loss When Using netfilter as a Firewall
Raik Niemann, Udo Pfingst, Richard G\"obel

TL;DR
This paper experimentally evaluates the throughput performance of Linux's netfilter firewall under various conditions, revealing small throughput losses related to rule count and address family, with insights into client handling techniques.
Contribution
It provides comprehensive experimental data on netfilter performance across multiple configurations, highlighting factors affecting throughput loss and comparing client connection handling methods.
Findings
Throughput loss is nearly linear with rule table size.
IPv4 and IPv6 address families impact throughput differently.
Client handling techniques like threads and epoll() show performance variations.
Abstract
Since GNU/Linux became a popular operating system on computer network routers, its packet routing mechanisms attracted more interest. This does not only concern 'big' Linux servers acting as a router but more and more small and medium network access devices, such as DSL or cable access devices. Although there are a lot of documents dealing with high performance routing with GNU/Linux, only a few offer experimental results to prove the given advices. This study evaluates the throughput performance of Linux' routing subsystem netfilter under various conditions like different data transport protocols in combination with different IP address families and transmission strategies. Those conditions were evaluated with two different types of netfilter rules for a high number in the rule tables. In addition to this, our experiments allowed us to evaluate two prominent client connection…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Packet Processing and Optimization · IPv6, Mobility, Handover, Networks, Security · Network Traffic and Congestion Control
