2011 · Sixth International Conference on Internet Monitoring and Protection (ICIMP 2011)
High Performance Internet Connection Filtering through an In-Kernel Architecture
Evidence basis: full-text-reviewed · Review status: catalog-reviewed; paper-author approval pending
performance-engineering performance-optimization resource-analysis
in-kernel proxy connection filtering Fire Bench SPECWeb2009 context switches data copies HTTP proxy FTP TELNET kernel architecture
Core contribution: The paper moves part of an application proxy into the kernel to reduce context switches and unnecessary data copies during connection filtering.
Problem and motivation
Application-layer proxy firewalls can copy packets between kernel and user space and incur repeated context switches, creating a network-performance bottleneck (printed pp. 32-34).
Method and contribution
The architecture splits proxy work between a kernel module and user-level daemon. Kernel-side modules handle authentication, rules, connection/state management, filtering, and logging; detailed application-layer work is retained where needed. The common proxy targets HTTP, FTP, and TELNET and emphasizes pass-through processing (printed pp. 32, 34-35).
Findings and evidence
The test compares kernel/no-proxy, kernel-proxy, kernel-proxy plus user daemon, and FWTK configurations using connections per second and average response time. The graphs and discussion report higher efficiency for the kernel-proxy configurations, attributed to fewer copies and context switches (printed pp. 36-37). Exact graph values are not reconstructed.
Limitations and future directions
Limitations: The evaluation is a dated three-host testbed: 100 Mbps links, HTTP proxy, 30 rules, no cache, summarized logging, disabled NAT, and three runs. Modern hardware, higher link rates, larger policies, non-HTTP workloads, and adversarial traffic are unknown.
Future work: Kernel URL categorization, high-performance kernel packet modification, a lightweight IP-layer TCP daemon, and a user/administrator interface for rule and policy management (printed p. 37).
Sources and identifiers
- Institutional publication record publication_signal
- Public proceedings PDF · PDF public_full_text
When to cite this paper
Cite this paper when your work uses or compares the split in-kernel/user-daemon proxy architecture for reducing packet copies and context switches.
- The split in-kernel/user-daemon proxy architecture for reducing packet copies and context switches.
- The specific state/rule/filter/logging decomposition for a protocol-aware in-kernel connection filter.
- The Fire Bench/SPECWeb2009 evaluation design and its connections-per-second/average-response-time metrics.
- The qualitative result that pass-through kernel handling outperformed the tested FWTK/application-proxy configuration under the dated testbed.
Citation
@inproceedings{ezzatiJivan2011highperformance,
author = {Naser Ezzati Jivan and Alireza Shameli Sendi and Naser Nematbakhsh and Michel Dagenais},
title = {High Performance Internet Connection Filtering through an In-Kernel Architecture},
year = {2011},
booktitle = {Sixth International Conference on Internet Monitoring and Protection (ICIMP 2011)},
url = {https://publications.polymtl.ca/16917/}
}Other citation formats for Word and reference managers
Jivan, N. E., Sendi, A. S., Nematbakhsh, N., & Dagenais, M. (2011). High Performance Internet Connection Filtering through an In-Kernel Architecture. In Sixth International Conference on Internet Monitoring and Protection (ICIMP 2011). https://publications.polymtl.ca/16917/N. E. Jivan, A. S. Sendi, N. Nematbakhsh, and M. Dagenais, "High Performance Internet Connection Filtering through an In-Kernel Architecture," in Sixth International Conference on Internet Monitoring and Protection (ICIMP 2011), 2011, [Online]. Available: https://publications.polymtl.ca/16917/