Re: [FW1] How many rules can exists in fw1 ?

[Vern Paxson <vern () ee lbl gov>]

> ... This means the amount of
> Inspect code is probably directly proportional to the overhead the
> firewall is going to experience each time it needs to analyze traffic.
>
> In short, make it concise, since more rules may slow down your firewall.

I don't know about Inspect in particular, but there are finite-automaton
style matchers that don't significantly increase in overhead as you add
more rules.  See this year's SIGCOMM proceedings for two papers on fast
matching:

        High Speed Policy-based Packet Forwarding Using Efficient
        Multi-dimensional Range Matching, T.V. Lakshman and D. Stiliadis

        Fast Scalable Algorithms for Level Four Switching,
        V. Srinivasan, George Varghese, Subash Suri, Marcel Waldvogel

Abstracts (and perhaps full papers) should be available off of:

        http://www.acm.org/sigcomm/sigcomm98/

- Vern