problem

By and large the performance annalysis of Network IDses, IPses and to a lesser extent firewalls are little better than a black art. From a network engeneerings' standpoint it is very difficult to get good information about a product before and sometimes after it is in place in the production network. The best recomendation seems to be buy the fastest device you can and hope. This collection of annalysis hopes to shed some more light on this sorry state of affairs.

The basic function of an IDS/IPS/Firewall is to rummage through the network traffic it is privie to and double check all each communication for safty. To some extent these devices are attempting to redo all the work that each of the network nodes is performing. Thus whatever work the network is doing, the device ends up doing or at least checking. This has rather large performance ramifications.

When network performance is discussed the first two metrics that come up are maximum bit rate and maximum packet rate. These metrics can do a good job of describing simple layer 2 and 3 network devices, but tend to become margionaly misleading for intelligent or complex devices. By examining devices in differing configurations with different traffic profiles we can begin to paint a better analytical picture of a give devices performance.