Subject: [bmwg] Firewall methodology changes

From: "Hickman, Brooks" <[email-masked]>
Date: Thu, 5 Jul 2001 12:37:42 -0700

The following reflects the changes to the firewall methodology draft. Note
that the section numbers referenced are for the latest draft as  significant
changes have been made to the document.  

Application layer traffic referenced in this document has been limited to
HTTP1.1. Verbiage referencing FTP and SMTP have been removed from all
sections.

Sections added:

5.4 Connection Teardown Time

Measures TCP connection teardown time as a function of the number of open
connections. As with the connection establishment time section, methodology
recommends measuring other connection oriented protocols in addition to TCP.

5.7 IP Fragmentation Handling

IP Fragmentation handing section determines impact on performance by
measuring goodput when also presenting the DUT/SUT with IP fragmented
packets requiring re-assembly. It is basically running the throughput test
with addition of IP/UDP fragmented traffic. 

5.8 Illegal Traffic Handling

The illegal frame handing section determines the DUT/SUT behavior when
presenting the DUT/SUT with both legal and illegal HTTP traffic. Again, it
is similar to the goodput test, only with a user defined percentage of the
traffic being defined by a rule(s) to drop.

5.9 Latency

The latency section provides a methodology for determining the latency
transversing a DUT/SUT, including procedures for network-layer or
application-layer data.

Sections Modified

5.3 Connection Establishment Time

Connection establishment time references changed to accommodate measuring
TCP establishment time with proxy based DUT/SUTs.

5.5 Denial of Service Handling

Added verbiage to include performing DOS(Denial of Service) test against
baseline goodput in addition to maximum connection establishment time.

APPENDICES

Appendix changed to discuss HTTP version considerations with regard to proxy
based DUT/SUTs.
 
Brooks Hickman
Senior Consultant
Phone:  818-676-2412
Fax:  818-880-9165
www.netcomsystems.com
[email-masked]