Tests for maximal data flow, number of filters and TCP connections through BMF with enabled State Firewall, NAT and configured filters.

This test shows high speed packet filtering and NAT implemented in BMF. The test was done on three machines connected with cross-over ethernet cable. In the middle machine is installed BMF.  First edge W2K3 machine runs testing application configured like server and second edge W2K3 machine runs testing application configured like client configured with many IP addresses to open predetermined number of TCP connections to the server. Every opened TCP connection transfers maximum possible amount of data in both directions through middle machine with installed BMF. Middle machine is Windows Vista 32-bit configured like router with help of built-in routing table, no routing software is used. Measurement was done with help of Windows built-in tool Performance Monitor. On the bottom of perfmon window is described counter type displayed on the graphs. In case of speed there is also "scale". Number on vertical y-axis must be divided by scale to retrieve measured value in Bytes/sec. Average measured value is already calculated and displayed under graph in units: Bytes/sec.
Every network software which does packet filtering can have impact to overall network speed and processor load. In BMF are important three factors: number of filters, enabled or disabled TCP inspection/NAT and bandwidth of network.
BMF filter corresponds to one or more computers in real network. Every BMF filter can permit from 1 to X TCP connections by it's configuration. I our test there was used filtering by source IP address.

Test results:

Comment:
Real maximal number of filters in configuration is depending on power of CPU, network cards hardware and network speed. With our hardware configuration we reached limit about 500 filters on Gigabit network. To reach higher number of filters on Gigabit network with contemporary BMF version there should be quicker CPU. If BMF is used on Fast ehernet (100Mbit) then number of filters can be higher. CPU must to search right filter for every packet so with higher speed there is needed higher number of searches. 

 

Graphs

Because of we want to know how BMF impacts overall speed and CPU load we first measured it without installed BMF. Graphs demonstrates power of Windows Vista built-in router. With increasing number of TCP connections there was decreasing of network speed.

TCP connections: 200
Average speed: 1.4Gbit
BMF is not installed.

TCP connections: 500
Average speed: 1.36Gbit
BMF is not installed.

TCP connections: 1000
Average speed: 952Gbit
BMF is not installed.

Results for 200 TCP connections and BMF configuration: TCP inspection, NAT, 200 filters:

TCP connections: 200
Average speed: 1.13Gbit
BMF configuration: 200 filters with unlimited bandwidth.

TCP connections: 200
Average speed: 1.26Gbit
BMF configuration: Firewall NAT

TCP connections: 200
Average speed: 992Mbit
BMF configuration: Firewall TCP inspection and 200 filters with unlimited bandwidth:

TCP connections: 200
Average speed: 912Mbit
BMF configuration: Firewall NAT and 200 filters with unlimited bandwidth:

TCP connections: 200
Average speed: 736Mbit
BMF configuration: Firewall NAT, 200 filters with limited bandwidth 4Mbit on every filter.

Results for 500 TCP connections and BMF configuration: TCP inspection, NAT, 500 filters:

TCP connections: 500
Average speed: 632Mbit
BMF configuration: 500 filters with unlimited bandwidth

TCP connections: 500
Average speed: 1.1Gbit
BMF configuration: Firewall NAT

TCP connections: 500
Average speed: 576Mbit
BMF configuration: Firewall TCP inspection and 500 filters with unlimited bandwidth

TCP connections: 500
Average speed: 528Mbit
BMF configuration: Firewall NAT, 500 filters with unlimited bandwidth

TCP connections: 500
Average speed: 405Mbit
BMF configuration: Firewall NAT, 500 filters with limited bandwidth 1Mbit on every filter

Results for 1000 TCP connections and BMF configuration: TCP inspection, NAT, 500 filters:

TCP connections: 1000
Average speed: 552Mbit
BMF configuration: 500 filters with unlimited bandwidth

TCP connections: 1000
Average speed: 800Mbit
BMF configuration: Firewall NAT

TCP connections: 1000
Average speed: 525Mbit
BMF configuration: Firewall TCP inspection and 500 filters with unlimited bandwidth

TCP connections: 1000
Average speed: 494Mbit
BMF configuration: Firewall NAT, 500 filters with unlimited bandwidth

This test was executed in cooperation with Zdeno Smondrk - external assistant of monthly magazine PC REVUE, Slovak Republic.