Re: Open Source vs Proprietary

Forjette, Joe wrote:

> > Dedicated hardware will give you more throughput. 
> >    
>
> This is quite a broad claim that may have been true a few years ago or for off 
> the shelf PCs, but today with the availability of 16 lane PCI Express buses 
> and custom chassis backplanes capable of pushing >80Gbps, I don't believe that 
> this statement still stands.
>  
It's a broad claim, sure, but please tell me where I can get hardware to
achieve 10Gbps throughput for my *bsd pf.

Anyone running a i386 firewall (pf for example) on a fully loaded Gbps?
Is it stable? No increased latency (more than normal) etc.? Would be
nice but I haven't had the guts to try it yet.

Application layer NIDS on fully loaded Gbps? No way.

> To your other point, there are vendors that are developing appliances with 
> pre-hardened *nix OSs that support both open source and proprietary 
> firewall/ips/ids/routing solutions. Some even provide cisco-like CLI 
> interfaces and GUIs with which to tweak the few OS internals that do need 
> configuring virtually eliminating the need to access a unix prompt and 
> consuming the knowledge and time resources you fear losing.
>  
Still interfaces like that are likely to reduce functionality. Say you
want a 16 segment VLAN firewall trunked to a Gbps switch, CARP
redundancy, Many IPsec assocs, Kerberos V over OpenSSH, add OpenVPN, 
then move it all over to IPv6. The vendor that's going to keep up to
speed with making plug and play GUIs for something like that just
doesn't exist.

Regards,
Fredrik Widlund