Testing iptables
Daniel Hoffman, Durga. Prabhakar, Paul A. Strooper · Conference of the Centre for Advanced Studies on Collaborative Research · 2003
iptables is the most recent entry in a series of Linux firewall services. Because iptables is a security product in widespread use, correctness and performance are important issues. We present a methodology for iptables regression testing. Typically, correctness test suites generate test inputs and then log the observed output to a file. Log files from the first execution are manually checked for correctness and then compared to the results from subsequent test runs with a file differencing utility. The log files tend to be large; checking their correctness is tedious and error-prone. In contrast, we generate test traffic and verify the correctness of the iptables behaviour from the same program, eliminating the need for log files. We also present performance test results, focusing on throughput and delay as a function of the size of the iptables rule base. The measurements were conducted over Ethernet links running at 10, 100, and 1,000 Mbps.