HP-UX IPFilter Performance White Paper

ManualsBrandsHP ManualsSoftwareHP-UX IPFilter Software

Introduction......................................................................................................................................... 2

Configuration...................................................................................................................................... 2

System Configuration ....................................................................................................................... 2

IPFilter Configuration ........................................................................................................................ 2

netperf Configuration ....................................................................................................................... 2

Summary of Test Results........................................................................................................................ 3

Inbound TCP (Streams) Test Results......................................................................................................... 4

Inbound TCP Throughput................................................................................................................... 5

Inbound TCP CPU Utilization ............................................................................................................. 6

Inbound TCP Service Demand ........................................................................................................... 7

Outbound TCP (MAERTS) Test Results ..................................................................................................... 8

Outbound TCP Throughput ................................................................................................................ 9

Outbound TCP CPU Utilization ........................................................................................................ 10

Outbound TCP Service Demand....................................................................................................... 11

TCP Connect, Request, and Response (CRR) Transaction Test Results ........................................................ 12

TCP CRR Transaction Rates.............................................................................................................. 13

TCP CRR Responder CPU Utilization................................................................................................. 14

TCP CRR Responder Service Demand ............................................................................................... 15

Inbound TCP Throughput Test Results with Varying Ruleset Sizes.............................................................. 16

For more information.......................................................................................................................... 18

Summary of content (18 pages)

PAGE 1
HP-UX IPFilter Performance White Paper Introduction......................................................................................................................................... 2 Configuration ...................................................................................................................................... 2 System Configuration ....................................................................................................................... 2 IPFilter Configuration ...
PAGE 2
Introduction IPFilter filters IP packets by reading the network protocol headers and comparing the values to a set of user-configured rules. Based on these rules, IPFilter either passes or drops the packet. Because IPFilter only reads the protocol headers, the size of an IP packet does not affect the speed at which IPFilter processes the packet, and IPFilter incurs the same overhead for an IP packet regardless of packet size. Packet size has little effect on IPFilter throughput.
PAGE 3
Summary of Test Results IPFilter has a moderate effect on network throughput. Throughput decreased 0 to 6.42% percent on a system with IPFilter rules configured compared to systems without IPFilter installed. Installing IPFilter and configuring IPFilter rules has a greater effect on system performance, as measured by CPU utilization rates. Test results using netperf show the average increase in CPU utilization rate is 8.46% when IPFilter is installed, even when no rules are configured.
PAGE 4
Inbound TCP (Streams) Test Results The netperf TCP Streams test measures unidirectional transmission of TCP data and does not include connection establishment time. In a TCP Streams test, the netperf client sends streams of TCP data to the netserver server. Measurements taken on the netserver system indicate performance for processing inbound packets. IPFilter is installed and configured on the netserver system.
PAGE 5
Inbound TCP Throughput Figure 1 and Table 1 show inbound TCP throughput for 512, 1024, and 8192 byte packets with three IPFilter statuses: no IPFilter installed, IPFilter without rules, and IPFilter with rules.
PAGE 6
Inbound TCP CPU Utilization Figure 2 and Table 2 show CPU utilization rates for systems processing 512, 1024, and 8192 byte inbound packets.
PAGE 7
Inbound TCP Service Demand Figure 3 and Table 3 show the service demand for 512, 1024, and 8192 byte inbound packets.
PAGE 8
Outbound TCP (MAERTS) Test Results The netperf TCP MAERTS test also measures unidirectional transmission of TCP data without connection establishment time. In a TCP MAERTS test, the netserver server sends streams of TCP data to the netperf client, so measurements taken on the netserver system indicate performance for processing outbound packets. IPFilter is installed and configured on the netserver system.
PAGE 9
Outbound TCP Throughput Figure 4 and Table 4 show outbound TCP throughput for 512, 1024, and 8192 byte packets with three IPFilter statuses: no IPFilter installed, IPFilter without rules, and IPFilter with rules.
PAGE 10
Outbound TCP CPU Utilization Figure 5 and Table 5 show CPU utilization rates for systems processing 512, 1024, and 8192 byte outbound packets.
PAGE 11
Outbound TCP Service Demand Figure 6 and Table 6 show the service demand for 512, 1024, and 8192 byte outbound packets.
PAGE 12
TCP Connect, Request, and Response (CRR) Transaction Test Results The netfperf connect, request, and response (CRR) test provides performance data for TCP transactions.
PAGE 13
TCP CRR Transaction Rates Figure 7 and Table 7 show the number of TCP CRR transactions per second for varying request and response packet sizes with three IPFilter statuses: no IPFilter installed, IPFilter without rules, and IPFilter with rules.
PAGE 14
TCP CRR Responder CPU Utilization Figure 8 and Table 8 show CPU utilization rates for the responder system in CRR tests with varying packet sizes.
PAGE 15
TCP CRR Responder Service Demand Figure 9 and Table 9 show the service demand for the responder system in CRR tests with varying packet sizes.
PAGE 16
Inbound TCP Throughput Test Results with Varying Ruleset Sizes HP tested TCP Streams inbound throughput with ruleset sizes ranging from 100 to 5000 rules. Each ruleset forced IPFilter to read every rule in the ruleset.
PAGE 17
3000 700.31 25.69% 4000 644.73 31.59% 5000 585.75 37.
PAGE 18
For More Information HP-UX IPFilter Version 15.01 Administrator's Guide www.docs.hp.com/en/internet.html#IPFilter www.software.hp.com © 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty.