Re: Proverbial appliance "Its software, Jim!"

[Mike Frantzen <frantzen () w4g org>]

> > Inside every "appliance" is an operating system. Inside
> > every ASIC or "embedded processor" is software. There's
> > really no difference other than the packaging. 
> Wake up and smell the caffine!
> Its all software.  
> THAT'S IT!  End of Story.
> All the heritage of s/w applies to "appliances".
>  - Keep it small and simple
>  - Test, test and test.
>  - Limit the complexity.
> If we can't learn that and apply it rigorously, what have we learnt?

Sigh.  Packet filtering, even stateful packet filtering is pretty easy
to do in hardware.  Unless you're a big fish, you'd probabley do it in
an FPGA as opposed to an ASIC.  Drop a CAM table off it to keep state
pointers and a few SRAMS to keep the actual state.  IIRC ISI even has
premade boards called OSIRIS with a 6M FPGA (which is HUGE) and it has a
PMC slot to drop the interfaces off of.  Or you could plug the
interfaces into the PCI bus off the other 1M FPGA.  Now it's been a
year, but IIRC the parts cost was about a grand.  You'd still probabley
drop an embedded micro off the PCI bus if you want to reassemble
fragments.


There are two applicable difference between a hardware firewall and a
software firewall.  In hardware, everything happens in parrallel (well,
every stage, you'll latch between stages to produce a sequential
pipeline).  And the other difference, is that hardware testing standards
are orders of magnitude better than software testing standards.

The first person who tells me VHDL or Verilog is software gets labeled
a dumbass.
 
> It
> doesn't matter if you're design tool is back-of-the-envelope or the best
> that Rational has to offer.  You're still human and fallible.

You'll find very few software people who acknowledge the fallibility.
But almost all hardware people not only acknowledge it, but they accept
it and plan for it.  The ideological difference creates a big
improvement in quality.

.mike
frantzen@(nfr.com | cvs.openbsd.org | w4g.org)
_______________________________________________
firewall-wizards mailing list
firewall-wizards () honor icsalabs com
http://honor.icsalabs.com/mailman/listinfo/firewall-wizards