3 ms·

And anyone who ever operated a stateful firewall cried a little bit inside.

• jiggawatts 5y ago
  I would argue that with 200 Gbps NICs starting to become mainstream, the era of stateful firewalls in general is over...
  • wmf 5y ago
    No see, the NIC now includes a stateful firewall so you can implement it at each server at line rate.
    • xxpor 5y ago
      Exactly. But every flow still uses memory, and with TCP you know when the connection has ended and can reuse it immediately. With general UDP (and QUIC because they intentionally put this in the encrypted part) the only way to do it is with timers. So you have both problems of state sticking around for a lot longer than needed if the timer is too long, as well as the state going away too early and breaking flows that wouldn't be broken otherwise because the timer's too short. I get why they made it hard for middleboxes to modify the connections, but they didn't have to make it hard to observe the state of the connection in order to do that.
  • caskstrength 5y ago
    NIC vendors will happily help you offload your stateful firewall to hardware.