Performance concerns when implementing infrastructure security in IPv4/IPv6 networks

Internet Service Providers (ISPs) throughout the world are beginning the rollout of IPv6 networks to cater for the increase in the number of devices connected to the Internet. Without the use of this technology the internet would not be able grow at the present rate. Network security has become a very important function of the network infrastructure since it has the ability to limit the packets that can be passed. This functionality is usually implemented as an Access Control List (ACL) within a router. ACLs are created from rules that specify the action to be taken for any packet which is tested and matched against it. Rules are put together to form an ordered. If a match is made on a particular rule the packet is either permitted or denied and no further rules are evaluated. This paper investigates the effect on the delays through a router when ACLs are implemented using an IPv6 addressing scheme. With the increase in the bandwidth of networks the delays through networking equipment can become significant and so this is the main area of research. A comparison is made with similar ACLs implemented in an IPv4 and IPv6 network. Additionally the tests are repeated using an IPv6-IPv4-IPv6 Tunnel to compare the delays with the previous results. To eliminate the uncertainties related to the internet performance a set of experiments were conducted on a laboratory network ensuring that the comparisons are consistent.