Linux firewalls VS. Windows firewalls

[Stef]

I've been toying with Linux for a while now, and I've recently learnt how to configure IPchains (built in firewall for the Linux kernel). Anyway, from what I have read, this IPchains filters frames comming to you PC. Its examines the headers and decides acording to the rules (that you have setup for IPchains) if the frame is to be rejected or not, it also has the ability to keep my probes in steath mode http://www.speedguide.net/ubb/biggrin.gif

I cant describe to you in detail more then that, but my question is: Do firewalls for Windows function in the same manner?

BTW, I tested my Linux firewall on the Shields UP website and it passed all ports scans, every port was in stealth mode and completely undetected!!! ZoneAlarm (what I ue for Windows) does pretty good too!!

[Stu]

I'm a linux user myself (been one for a number of years now).

My understanding of ipchains is that the filtering takes place at the network and transport layers because of it being part of the kernel. However, I would imagine, many of the windows firewalls filter at the application layer.

In either case the packets get filtered, however it may take a nano-second longer to do so on the windows firewall since it would have to travel to two additional layers before a decision was made.

[Stef]

A Linux Guru eh!! Maybe you could help me out with a tweak that I'm working on. I've found out how to increase the maximum and default receive and send windows in Linux. Currently I have both set at 65535 bytes with selective acknolegments enable and time stamps and window scaling enabled as well.

What I'm trying to find out is what is the largest send/receive window that Linux will allow http://www.speedguide.net/ubb/biggrin.gif

BTW, I found out how to tweak the Linux TCP/IP settings thanks to this site:
http://www.psc.edu/networking/perf_tune.html#Linux

[goose]

I have a question for you two. When I use my Linux box on the net, I get very serious net collisions from my hub. My throughput is way faster than my Winders machine. But the transfer signals seem to sort of hop. I don't know of any other way to put this but I'll try. While running Winders my cable modem lights seem to send and wait for a response to transmit again. And it does it fairly at a quick rate. Once in a while i will see a net collision indication but not to often. Now, on my linux machine I get them all the time and the transmission seems to jolt like it sends then receives and then halts for a breif moment and starts again. It does this i'd say 3 times a second until the file is done. Everytime, I get the net collision indicator going crazy. I hope that I explained that so you'd understand. What is that doing and why?

[Stu]

Stef:

Actually, I never saw the need to "tweak" my linux machines. They smoke on the internet.

Talking about the packet size though, bigger isn't always better. Smaller packets usually don't slow you down. In fact, they are better in some cases. For instance, if I have data being sent or received that has been "tainted" during transmission, re-sending one small packet vs. one large packet is preferable.

goose:

Assuming you are running a typical/inexpensive hub and have your windows box up and running while you are on your linux machine--and there are no technical problems on your subnet.

I would venture to say that your windows box is causing the problem. I say this because windows (at least 9x) sends out packets even if you aren't using it, things like the "critical update" program and other such background programs do this. Linux doesn't typically do this, so it wouldn't interfere with the windows packets. And since you aren't using a "smart" hub, switch, or router (which in effect "meter" who sends and when) your linux packets collide w/ the windows packets.

There are two quick fixes if this is the case. First option, get a "smart" hub, switch, or router, this will be a little more expensive than a bare-bones hub. Second option, shutdown your windows box or unplug the NIC when you are on your linux machine(this kind of defeats the purpose of having a network). I would try the latter before buying any hardware, to see if this in fact is the problem.

[This message has been edited by Stu (edited 08-22-2000).]

[Stef]

I know what you mean, Linux Mandrake outperforms Windows 98 for networking any day!! I have applied all of the TCP/IP tweaks for Windows, to my surprise Linux still communicates over the web faster then Windows http://www.speedguide.net/ubb/biggrin.gif I can even download faster in Linux without using any special download accelerator programs!!

But, that still aint enough for me http://www.speedguide.net/ubb/smile.gif Faster is always better!!

[Snip]

I'm thinking about changing my pc setup and make it dual boot with 98se and lenux (I have been wanting to test lenux), Am I going to have problem finding drivers for my NICs and analog modem? Would be a good idea to begin with? I have heard that there are many sites on the web to help setup lenux and I should probably start asking questions on some of those sites, but, I wanted to get a windows user opinion on the matter.

[WhiteTrashGOD]

First of all, it's Linux - not Lenux. Secondly, what type of NIC and modem are you using. Most NICs and modems will be detected by Linux without any additional drivers. If you are new to Linux, I suggest using the Mandrake distro. It is 100% compatible with RedHat and is very easy to setup.

------------------
-=WhiteTrashGOD=-

"I'll never get out of this world alive." - Hank Williams

"I'm leaving on a jetplane..." - John Denver

"...I swear I don't have a gun..." - Kurt Cobain