Subject: [bmwg] measuring TCP connection setup on proxy firewalls

From: Steve Cook <[email-masked]>
Date: Wed, 11 Apr 2001 13:40:12 -0400

I am new to this discussion and may not be aware of the ground rules.
However, taking a chance on breaking some rule or sensibility, I would like
to interject my observations based on how our firewall proxy works
(specifically http) and ask a question or two.

Using the timing labels provided by David Newman, I would say a major amount
of the setup work for our proxy is done in response to t0 since a child is
spawned (if not already available) to handle the connection.  This is where
the proxy is likely to introduce most of its latency.  Hence, I think t2-t0
is valuable information.  Another point is that, in usual cases, t4 is
likely to happen during t3 since the client thinks it is already connected
to the server.  This means that the datagram from the client is likely to be
at the proxy, "on deck", ready to be sent to the server as soon as the proxy
sends its ACK to the server, establishing the connection.

I take it t4 refers to the time the client sends the datagram to the proxy
thinking it is the server.  I am a little confused about the relevance of t5
since the client wouldn't be aware of this time, which brings me to a
question.  Does the test methodology make assumptions about the test tool?
Specifically, if the test tool "owns" both client and server, that is - they
are both on the same clock and their metrics are accessible, I would think
the discussion about collecting and deriving test data solely from the
client's perspective would be moot.  

Stephen A. Cook
Release Engineering

CyberGuard Corporation
[email-masked]
Office: (954) 958-3900 x3238

CyberGuard firewall appliances first ever to get Common Criteria EAL4
certification! 
http://www.cyberguard.com/awards/index_ie.asp.

_______________________________________________
bmwg mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/bmwg