[ILUG] Firewall Overhead.

[David Murphy]

Quoting <Pine.LNX.4.21.0006271707040.3203-100000 at rossi.itg.ie>
by Paul Jakma <paulj at itg.ie>:

> i was wrong, as i often am. but that's why i'm on this list, to
> learn. people say stuff, if they're wrong they are hopefully
> corrected and they and the list learn from it. If they're right, the
> list learns.

Well, I can't do those big emotional soliloquies like Kenn can, but I
hope we can all just learn not to dismiss other people's opinions
because we think they're trolls because they're saying Linux is bad.

> > kernel, hence they hadn't put it in. However, you seem to have
> > changed your opinion of their opinion:

> wow.. really have to watch your words when talking to you.

You should try having me as a customer ;)

> To be specific: my personal opinion that stuff like filtering should
> be in kernel is unchanged.

What about your opinion of where stateful filtering should be?

> my preffered way of implementing filtering in userland is by using
> application proxies such as squid, or by implementing other local
> network services such as sendmail, DNS, such that local clients do
> not have to access outside stuff.

I guess you could call that 'filtering', but 'filtering' generally
implies operating on network connections from your hosts to other
people's hosts, rather than having your hosts talk to other hosts of
yours which then talk to other people's hosts on their behalf (almost
by proxy, you might say.

> > > > The Linux kernel developers seem to disagree with you.
> > > good for them. they know better than i do.
> > No argument here.

> you should be a lawyer. clever statement that, you know there's no
> way i can disagree, eg: "actually yes i do know better than the
> kernel developers" :).

"So Mr. Jakma, when did you stop beating your firewall?" 8)

> > So, we can categorically state that it was a machine, and had RAM
> > in it. 

> a hefty amount of it. 

640MB on a desktop PC might be a hefty amount of RAM, but 256MB on a
server is a sensible minimum.

> > Nearly everything is dynamically loaded into the kernel.

> nifty.. still slow though. :)

It's the fastest OS available on current Sun hardware that has the
stability and support we need. I can't speak for its performance on
IPXes or whatever.

-- 
When asked if it is true that he uses his wheelchair as a weapon he will reply:
"That's a malicious rumour. I'll run over anyone who repeats it."
Stephen Hawking - [http://www.smh.com.au/news/0001/07/features/features1.html]
David Murphy - For PGP public key, send mail with Subject: send-pgp-key