[ILUG] Firewall Overhead.

[Smelly Pooh]

In reply to Paul Jakma's flatulent wordings, 
> On Mon, 26 Jun 2000, Smelly Pooh wrote:
> 
> > To get a rise out of you paul
> 
> :)
> 
> fyi i'm still sitting.
> 
> [snip discussion of static vs statefull firewalling]
> 
> > The 2 free firewall packages I know of that keep state are ipfw (for
> > FreeBSD) and ipfilter (which is surprisingly portable for a packet
> > filter, runs on *BSD, solaris, irix, hpux and even Linux, although
> > from what I hear the Linux version only works with older kernels).  
> > Commercial packages like Firewall-1 also keep state.
> 
> the one thing you left out:
> 
> stateful firewalling by it's very nature needs a lot more resources
> compared to static rule fw, esp wrt to memory. so the linux view is
> probably: 'doesn't belong in kernel -> belongs in user space' ie a
> firewalling application.

It turns out that linux 2.4.x will have stateful firewalling afterall (and all
this despite the linux view I tell you :}).  I just don't get it, it takes up
so much more resources, (esp wrt to memory) and adds so much complexity, yet
the maintainer of the Linux 2.4 Packet Filtering HOWTO had the audacity to
spout

"The most useful match criterion is supplied by the `state' extension, which
interprets the connection-tracking analysis of the `ip_conntrack' module. This
is highly recommended."