[ILUG] Firewall Overhead.

[Paul Jakma]

On Tue, 27 Jun 2000, David Murphy wrote:

> Quoting <Pine.LNX.4.21.0006271333540.3203-100000 at rossi.itg.ie>
> by Paul Jakma <paulj at itg.ie>:
> 
> > i'm sure he does. and i never said stateful firewalling wasn't good
> > either. i just said that lambasting linux for not having full blown
> > stateful firewalling like your $CHOSEN_OS is unjustified.
> 
> Actually no. You said that Linux didn't have stateful firewalling
> because stateful firewalling didn't belong in kernel space. 

didn't say that. expressed personal preference to keep things in userland
where-ever possible. 

anyway, my comment above doesn't say anything about whether i think
stateful firewalling should be in kernel or not.

> The Linux
> kernel developers seem to disagree with you.
> 

good for them. they know better than i do.

> What did they have on their application proxies?
> 

not sure. hence the 'anecdotal' tag. it was to allow access to the
call-logging systems (SQL servers) from customer sites thru leased lines.
Alta-Vista firewall i don't know much about, other than it bolts on top of
DU. Don't know how much of it is kernel or how much is user space - but it
does need a good bit of RAM.

> It should have been clear from the context that he was referring to
> your mythical user space stateful inspection firewall, not user space
> application proxies.

so? draw the parallel fer chrisake..

squid goes down -> no www access
userspace firewall goes down -> absolutely no access

(cause the application is doing the forwarding/proxying. The kernel won't 
forward)

> Actually, I daresay you could find more features available in the
> Linux kernel and not in a given SysV kernel than vice versa. Besides,
> if Solaris is anything to go by, a SysV kernel is less likely to
> contain code you're not using than Linux is.

and it's still slow on little boxes.

anyway: can you be more specific about that paragraph? i'm curious, do you
mean Solaris has few features, or that nearly everything is dynamically
loaded into the kernel, or something else?

> 
> 

--paulj