Testing iptables

  • Authors:

  • Daniel Hoffman;Durga Prabhakar;Paul Strooper

  • Affiliations:

  • Department of Computer Science, University of Victoria, PO Box 3055 STN CSC, Victoria, BC V8W 3P6;Department of Computer Science, University of Victoria, PO Box 3055 STN CSC, Victoria, BC V8W 3P6;School of Information Technology and Electrical Engineering, The University of Queensland, Brisbane, Qld. 4072, Australia

  • Venue:
  • CASCON '03 Proceedings of the 2003 conference of the Centre for Advanced Studies on Collaborative research
  • Year:
  • 2003

Quantified Score

Hi-index 0.00

Visualization

Abstract

iptables is the most recent entry in a series of Linux firewall services. Because iptables is a security product in widespread use, correctness and performance are important issues. We present a methodology for iptables regression testing. Typically, correctness test suites generate test inputs and then log the observed output to a file. Log files from the first execution are manually checked for correctness and then compared to the results from subsequent test runs with a file differencing utility. The log files tend to be large; checking their correctness is tedious and error-prone. In contrast, we generate test traffic and verify the correctness of the iptables behaviour from the same program, eliminating the need for log files. We also present performance test results, focusing on throughput and delay as a function of the size of the iptables rule base. The measurements were conducted over Ethernet links running at 10, 100, and 1,000 Mbps.