On Thu, 16 Dec 2004, Chris Buechler wrote:
> I'd go with crossover cables only between devices (eliminate any
> influence a switch might have), and try NAT and routing speeds
> > I believe that we can do this at work. My coworker is also interested
> > in the results. He is a believer in PIX and I'm a m0n0wall
> > evangelist, however I believe together we can give good fair testing
> > and results.
> I just ran iperf from LAN to DMZ (routing, no NAT) on a 515E at a
> steady 91-92 Mb.
> Compared to Soekris and WRAP, that blows them out of the water, but we
> aren't talking even close to the same class of hardware (that PIX
> costs around 12 times as much as a Soekris or WRAP).
For WRAP and Soekris , yes, but you should more Compare a Cisco 501 with a
Wrap , its (almost) the same size ;)
> hardware and m0n0wall will come out way ahead. m0n0wall should come
> out ahead on less than half the hardware, dollar wise, as a rough
There are decent barebone firewall systems out there.
I have a G478 from Iwill, and Portwell also makes some fine boxes.
They should be a closer Match to a 515E (only have an 515 without E at
> I'm a Cisco nut myself, but I'll take a m0n0wall over a PIX any day.
> iperf is probably a good tool for the job, but that only tests a
> single TCP stream. That's a good indicator of max throughput, but not
> of how scalable the firewall really is (you aren't going to push 92 Mb
> through your firewall on a single TCP stream, generally, maybe over a
> few thousand TCP connections). I'd hit Google and see what kind of
> other testing tools you can dig up. I'd definitely be interested in
> anything you come up with.
You could also try the free availble tool Qcheck from ixia.
e-mail: robert at bay13 dot de
1024D/9723F471 : 90A9 6761 A630 583D F6DB 6A8C C570 7719 9723 F471