How long does it take to offload traffic from firewall?
| dc.contributor.advisor | Gurkan, Deniz | |
| dc.contributor.committeeMember | Shireen, Wajiha | |
| dc.contributor.committeeMember | Merchant, Fatima Aziz | |
| dc.creator | Narisetty, Raja Revanth 1988- | |
| dc.date.accessioned | 2014-03-13T22:18:36Z | |
| dc.date.available | 2014-03-13T22:18:36Z | |
| dc.date.created | December 2013 | |
| dc.date.issued | 2013-12 | |
| dc.date.updated | 2014-03-13T22:18:42Z | |
| dc.description.abstract | Demonstration of how intelligent steering of classified application traffic with flows in OpenFlow protocol can alleviate firewall bottleneck issues. Irrespective of the available higher bandwidth capabilities of the network, traffic passing through a firewall, where every packet is statefully inspected and/or deep packet inespected (DPI), causes bottlenecks. Isolation of the classified application traffic from all other traffic by means of VLANs and MPLS has been proposed, and is being implemented. Our demonstration leverages the SDN paradigm and flow isolation is achieved by programming the forwarding plane in conjunction with a dynamic utilization of a firewall’s application-aware DPI capabilities and other analytics. In this respect, as soon as classified application traffic session has been positively identified by the firewall, a flow rule can be written to offload the remainder of the data transfer from the firewall to a fast path on the switch. All sessions are inspected by the firewall, but not all packets of every session need to pass through the firewall. Thus the security is preserved and the throughput constraint is removed. The demonstration utilizes a virtual distributed firewall product from vARMOUR Networks, Inc. to deliver software defined security, SDSec. Once an application is identified for a new session (occurs within a small number of packets, usually less than 10), and the session is to be permitted, the remainder of the session’s packets are steered to a fast path on an OpenFlow switch using as a flow definition that exists for the duration of the session. We present the research investigations on the trade-offs for such a fast path mechanism through the network, considering processing delays introduced by the mechanism. Namely, an optimal session length should be determined for such a fast path mechanism to be worthwhile in a campus network. The main delay components to be measured and presented include: a flow setup requires a controller to push flows respective to programmable, the flow redirection takes time as such a flow should be activated at the programmable switch, and the network delay associated with the setup process. ‘What Is The Ideal Length Of Session To Benefit From The Intelligent Application Steering Based Dpi Offload Solution?’ For the application traffic to benefit from this intelligent offload of deep packet inspection solution, determining the ideal length of the session on the firewall is the objective of this work. In other words, we determine ‘How Long Does It Take to Offload Traffic from the Firewall?’ which is the ideal length of the session on the firewall for this intelligent offload solution. | |
| dc.description.department | Engineering Technology, Department of | |
| dc.format.digitalOrigin | born digital | |
| dc.format.mimetype | application/pdf | |
| dc.identifier.uri | http://hdl.handle.net/10657/574 | |
| dc.language.iso | eng | |
| dc.rights | The author of this work is the copyright owner. UH Libraries and the Texas Digital Library have their permission to store and provide access to this work. Further transmission, reproduction, or presentation of this work is prohibited except with permission of the author(s). | |
| dc.subject | Firewall bottlenecks | |
| dc.subject | Deep Packet Inspection | |
| dc.subject | Application Steering | |
| dc.subject | Flow Setup Time | |
| dc.subject.lcsh | Computer networks | |
| dc.title | How long does it take to offload traffic from firewall? | |
| dc.type.dcmi | Text | |
| dc.type.genre | Thesis | |
| thesis.degree.college | College of Technology | |
| thesis.degree.department | Engineering Technology, Department of | |
| thesis.degree.discipline | Engineering Technology | |
| thesis.degree.grantor | University of Houston | |
| thesis.degree.level | Masters | |
| thesis.degree.major | Networks and Communications | |
| thesis.degree.name | Master of Science |