LATENCY AND THROUGHPUT COMPARISON BETWEEN IPTABLES AND NFTABLES AT DIFFERENT FRAME AND RULE-SET SIZES

Sammanfattning: Firewalls are one of the most common security tools used in computer networks. Its purpose is to prevent unwanted traffic from coming in to or out of a computer network. In Linux, one of the most common server operating system kernels available, iptables has been the go-to firewall for nearly two decades but a proposed successor, nftables, is available. This project compared latency and throughput performance of both firewalls with ten different rule-set sizes and seven different frame sizes using both linear look-ups and indexed data structures. Latency was measured through the round-trip time of ICMP packets while throughput was measured by generating UDP traffic using iPerf3. The results showed that, when using linear look-ups, nftables performs worse than iptables when using small frame sizes and when using large rule-sets. If the frame size was fairly large and rule-set fairly small, nftables was often performed slightly better both in terms of latency and in terms of throughput. When using indexed data structures, performance of both firewalls was very similar regardless of frame size or rule-set size. Minor, but statistically significant, differences were found both in favour of and against nftables, depending on the exact parameters used.