FreeBSD 7.X/8.0: Firewall performance with pf,
ipfw or ipf? Any benchmarks available?
O. Hartmann
ohartman at mail.zedat.fu-berlin.de
Sun Jul 13 11:09:31 UTC 2008
Hello,
since FreeBSD 5.0 I was using 'pf' as the packet filter on FreeBSD due
to some performance advantages over ipfw in the time when FreeBSD was
introduced. Now I'm al littel bit detached from development and status
quo. I read about problems in FreeBSD 7 when using 'pf' in a bridged
environment, CPU load increaeses and packet drops are the result (on an
IBM Server with Intel em0/1 NICs).
Well, I'm pleased that FreeBSD comes with at least three packet filters
(ipfw, ipf, pf), but at the end, the choice is up to me and in question
of the better support and performance this leaves me alone in the dark.
So, does any of the network experts do have benchmarked any of the
packet filters? what is the preferred selection if someone would like
to have a 'simple' packetfilter (no usage of special features of one of
the mentioned packetfilters except of bridging and LAGG)? Talking about
FreeBSD 8's virtualiziation capabilities on network stack: will this
have implications on what filter will work or not (if ever, I do not
know how abstract this virtualization is indeed from the packet
filtering layer).
So, sorry for the little confuses,
Oliver
More information about the freebsd-questions
mailing list