Great Circle Associates Firewalls
(November 1995)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: Firewalls review in Data Com
From: jim @ SmallWorks . COM (Jim Thompson)
Date: Mon, 27 Nov 1995 01:21:44 -0600
To: firewalls @ GreatCircle . COM, pshuang @ sgihub . corp . sgi . com

Ping Huang <pshuang @
 sgihub .
 corp .
 sgi .
 com> said:

>A packet collision rate on an Ethernet probably
>results in only slightly degraded performance for users; however, a 5%
>rate of failed connections (and there were several combinations of
>vendor products and the number of established virtual circuits in
>Table 3 in the article which had that loss rate or higher) would mean
>that about 5% of attempts to access a given home page will time out,
>and a much higher percentage of Web pages will be displayed with a
>missing inlined graphic.
>[...]
>Table 3 in the article which had that loss rate or higher) would mean
>that about 5% of attempts to access a given home page will time out,
>and a much higher percentage of Web pages will be displayed with a
>missing inlined graphic.

a) "3 out of 1000" is much less than 5%.  You're off by a factor of 16.

b) this kind of load-related failure scenerio is where packet filtering
   can really shine, especially when coupled with the ability to insert
   the 'features' of proxies into the connection startup.  (And then to
   not have the proxies 'in the way'.)

c) NTSL's testing methods leave much to be desired.  (Don't make me tell
   you about the grot they spoon out in order for a PC to be 'NTSL certified'.)

d) I don't like how you got from dropped packets (or even closed sessions)
   to missing inlined graphics.  Don't bother explaining, I think I
   grok your train of thought, I just think its a bit over-selective.

How do we know that the firewall(s?) that looked constipated were not, in
fact, sending back some flavor of ICMP message that resulted in the dropped
sessions?

Jim


Follow-Ups:
Indexed By Date Previous: Re: Firewalls review in Data Com
From: Ping Huang <pshuang @ sgihub . corp . sgi . com>
Next: Re: Solaris for firwall
From: Matthew Cable <mec @ itg . net>
Indexed By Thread Previous: Re: Firewalls review in Data Com
From: Ping Huang <pshuang @ sgihub . corp . sgi . com>
Next: Re: Firewalls review in Data Com
From: Ping Huang <pshuang @ sgihub . corp . sgi . com>

Google
 
Search Internet Search www.greatcircle.com