> Could Someone please tell me the advantages of PF against Firewalls > using the ASIC technology in terms of Security and perfomance??
Many (most? all?) vendors shipping what they call ASIC firewalls are actually running software on a network processor (NPU). The benefit is that most NPUs will process packets in real-time so if they claim to support X gigabit per second then they can probably sustain that even with minimum sized 64byte ethernet frames; a PF box doesn't stand a chance with that high of a pps rate. The down side to NPUs is that they have to service every packet in a fixed amount of time so they can't do much. They need to have fixed sized state and fragment reassembly tables. They also aren't allowed to do much work per packet. You will also be able to surf Moore's law better with a normal x86 processor than with an NPU. Technically, your intel processor is an asic too. .mike > I happened to hear the following > > "Netscreen is running in ASIC (they are boasting in their marketing) - > and thus probably only is checking the first (or first few) packages and > then handing all traffic control off to dumb packet shoveling hardware. > So probably no checks "later" in the protocol. Similar problem with > CheckPoint's "fastpath" option, btw." > > Thankyou so much > > kind regards > > Siju
