Subject: [bmwg] measuring TCP connection setup on proxy firewalls

From: "David Newman" <[email-masked]>
Date: Fri, 30 Mar 2001 13:19:43 -0500

Brooks Hickman and I have been working on the firewall performance
methodology draft, and a question has come up about measuring TCP connection
times.

An issue arises when benchmarking application-proxy type firewalls. These
involve the setup of two TCP connections for each client request: one
between client and proxy, and another between proxy and server. It's easy to
measure overall connection setup time between client and server, and indeed
this is what is most interesting for end-users. But implementers of
proxy-based devices are probably very interested in setup time to the proxy
itself.

And therein lies the problem. Since TCP connection setup involves an odd
number of messages (syn, syn/ack, ack), a handshake that begins on the
client ends on the proxy. Few if any proxies are also test instruments, so
it's not possible to make a direct measurement of client-to-proxy connection
setup time.

Here's a proposed workaround. It's not a direct measurement, but it's the
closest thing I can think of:

t0: Client sends SYN
t1: Proxy sends SYN/ACK
t2: Client sends ACK
t3: Proxy establishes separate connection with server
t4: Client sends TCP datagram to server
t5: Proxy sends ACK of datagram to server

I propose we call connection setup time the interval represented by (t4-t0).
We don't measure the interval represented by (t5-t4) but this step is
necessary to verify that the proxy connection is established - i.e., that
the ACK sent at t2 wasn't lost.

Again, this is not a direct measurement and as such it can't account for
proxy weirdness like t3 taking a long time. However, it does give us at
least a half a clue about proxy connection setup time. Comments? Is there a
better way to do this?

David Newman

_______________________________________________
bmwg mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/bmwg