Re: [sami] A new draft on state migration use cases is submitted.

[A tao <[e-mail]>]

No doubt that a performance test results can help people to understand, to
some extent, why there are requirements and implementations to move security
functions, such as firewall/DHCP snooping/ACLs, out of Hypervisor or
servers.

If Ming can provide this results, that will be best.

We don't have the data but we also talked with DC providers, and they gave
me an example to explain why they want the firewall being executed by
network side. They deployed a VM to run Firewall functions on a x86 server.
And by test, they find the firewall consumes more than large amount of CPU
capacity which otherwise can be used to support 2-3 VMs. I don't get the
real data and the test situation, this is only a information.

2011/10/11 Juergen Schoenwaelder <[e-mail]>

> On Tue, Oct 11, 2011 at 06:06:34AM +0000, 卓志强(研七 福州) wrote:
> > I have the following documents to get some reference data,
> > http://people.netfilter.org/kadlec/nftest.pdf
> >
> > The "filtering rules" is like ACLs. As the numbers increase, the
> > performance of different software have declined.
>
> Your proposition is that moving filtering rules from the endpoint (the
> hypervisor) into the network is cheaper and easier to scale. To make
> any sense of the above quoted document, I would need to know what the
> performance of middleboxes is going to be and I would need to know how
> many hypervisors are going to be behind a middlebox. If its lets say
> 1:10 (one switch to ten hypervisors), then the middleboxes would need
> to outperform a kernel software filter by a factor significant larger
> than 10. I guess you have done this calculation so it should be easy
> to provide a concrete data point.
>
> Once the scalability trade-off is clear, one can look at the costs of
> the various options (essentially more hypervisors vs. fancier switches
> that peak into L4 and perhaps even beyond). I would love if problem
> statement documents would go into exactly this level of detail.
>
> /js
>
> --
> Juergen Schoenwaelder           Jacobs University Bremen gGmbH
> Phone: [phone]         Campus Ring 1, 28759 Bremen, Germany
> Fax:   [phone]         <http://www.jacobs-university.de/>
>