As a part of my research, I need to determine the maximum packets (Internet traffic) can one instance of firewall/ IDS process. I am not sure where to begin though.
Your assistance and guidance in this regard is much appreciated.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Having done tests for multiple clients where they claim "scans won't knock this over, you'll be alright", then an hour later we're having a meeting discussing how they're going to handle a serious downtime incident, I can safely say a few things:
If you want to properly test the realistic capabilities one of these devices, you need to install it in your production environment and run a full battery of tests through it, in your final production configuration. The results will be different for each model or version of the firewall/IDS/IPS, different config options, and different networking topologies and backend systems being reached through the device. Whatever answer you gain for, say, a pfSense firewall, will be entirely different than, say, a Checkpoint firewall.
Since you're talking about research, the first thing you should do is define what you mean by firewall and IDS. They are different things; at a trivial level, a (stateful) firewall is concerned with the network layer, while an IDS must do at least some packet inspection and application-level analysis to be useful.
While there are other kinds of firewalls and IDS, what limits their throughput is ultimately the slowest element in the processing chain. Here is a trival example:
/dev/logand then forgets about it
In this case the components involved are:
The slowest element of the chain is the PCI bus, so that's the limiting factor in case of single packets. This means that unless you put a 10Gb card on a 486 CPU with a clock of 100 MHz, the network card will always be the bottleneck. It's a back-of-the-envelope calculation but it gives you a lower boundary.
Once you have a baseline you can start complicating it: for example, what if the system is overloaded? What's the minimum number of threads your CPU must be able to allocate in order to keep up with a maximum throughput? In other words: isolate your variables and, keeping everything else the same, analyse their boundaries. You might consider a boundary analysis approach.
You also need to clarify your research question: you talk about
the maximum packets (Internet traffic) can one instance of firewall/ IDS process
What do you mean by "process"? Is your IDS active or passive (e.g. does it block packet flow until it's happy, or does it do passive analysis only)? If it's blocking, you have a producer/consumer queue model where your upper bound depends on whether the IDS can scale over multiple cores. Other things you may want to consider are memory footprint, susceptibility to denial-of-service attacks, and so on. Think about what happens if an attacker sends one fragmented packet. Will the firewall wait forever to assemble it? What if the attacker sends only the first chunk of a chunked HTTP request?
To sum up - start by defining exactly what you're trying to assess; for each element, determine its lower and (possibly) upper bounds; combine the results.