Re: Re: High Speed Firewalls

[Dug Song <dugsong () monkey org>]

On Tue, 7 Mar 2000, Crispin Cowan wrote:

> The more inspection you try to do at "line speed", the more computes
> you're going to need in the firewall.  But if you throw enough CPU
> hardware at the problem, you certainly can get the firewall to process
> packets at line speed bandwidth...

more horsepower is more horsepower, sure.

but at some point, you need to work smarter, not harder.

"network processors" are specialized CPUs for just this purpose - i think
we'll be seeing more of these in high-end network devices (firewalls,
IDSs, etc.) in short order. be sure to check out the NPUs from Solidum,
who seems to be leading the pack in this area:

        http://www.solidum.com/

(i'm neither an employee nor a customer of theirs, just an impartial
academic:-)

-d.

---
http://www.monkey.org/~dugsong/