Chapter 36 — Network and communications security: performance and scale
Lesson map
Lesson 36 published. Map, example, EX106.
flowchart TD
N0["Learning outcomes"]
N1["36.1 Latency budget"]
N2["Lab — Added latency"]
N3["36.2 Reading the measurement"]
N4["36.3 Capacity under load"]
N5["36.4 Scaling the policy"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX106"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["36.1 Latency budget"]
N2["Lab — Added latency"]
N3["36.2 Reading the measurement"]
N4["36.3 Capacity under load"]
N5["36.4 Scaling the policy"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX106"]
[Learning outcomes]
|
v
[36.1 Latency budget]
|
v
[Lab — Added latency]
|
v
[36.2 Reading the measurement]
|
v
[36.3 Capacity under load]
|
v
[36.4 Scaling the policy]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX106]
Learning outcomes
You will (1) measure latency added by controls; (2) check capacity under load; (3) plan for growth.
36.1 Latency budget
The council's phone system and file access are sensitive to delay, so the new firewall hop must not noticeably slow them. Kofi sets a budget: the firewall must add less than one millisecond at the main office under normal load. He derives this from the phone provider's guidance on acceptable end-to-end delay and the baseline measured early in the project, reserving most of the allowance for existing switches, links and distance between offices. A written budget turns a vague worry about slowness into a number that can be measured, tested and either met or missed.
Lab — Added latency
"""Added latency through the new firewall: percentiles from synthetic samples in ms (stdlib only)."""
import statistics as st
s = [0.21,0.24,0.22,0.25,0.30,0.23,0.26,0.28,0.22,0.24,0.31,0.27,0.25,0.23,0.95,0.26,0.24,0.29,0.22,0.25]
q = st.quantiles(s, n=100)
print(f"n {len(s)} median {st.median(s):.3f} p95 {q[94]:.3f} max {max(s):.3f} ms; budget 1.0 ms met: {max(s) < 1.0}")
Run with python3 lab_latency.py. Verified output:
n 20 median 0.250 p95 0.918 max 0.950 ms; budget 1.0 ms met: True
36.2 Reading the measurement
The lab reports twenty synthetic samples with a median of 0.25 milliseconds, a 95th percentile of about 0.92 and a maximum of 0.95. The budget is met, but the tail sits close to it, so Kofi looks at the slowest sample rather than stopping at the median. He links it to a burst of new connections when the nightly backup starts, which matches the slow-path behaviour for connection set-up described earlier in the course. He recommends staggering backup start times across servers, a cheap change that reduces bursts without altering any security rule.
36.3 Capacity under load
Latency at normal load says little about busy periods. Kofi runs throughput tests in the lab with all inspection features enabled, since vendor figures often assume features are switched off. The main firewall pair carries about twice the council's measured peak traffic, and branch firewalls about three times their local peak. The connection-state table stays below a third of capacity at peak. With the growth rates estimated in the planning chapters, these margins cover roughly five years, which matches the expected replacement cycle and avoids buying larger equipment than the council needs.
36.4 Scaling the policy
Traffic is not the only thing that grows; the policy grows too, and larger rule bases tend to contain more errors, as Wool's study of firewall configurations found. Kofi keeps the policy template-based, so adding an office means adding its local subnet values rather than writing new rules. He also sets a review trigger: when the total rule count rises by twenty percent from the approved baseline, the team reviews the whole policy for unused, overlapping or overly broad rules. This keeps growth deliberate rather than letting the rule base drift into the complexity that caused trouble before.
Worked example
After staggering backups, a repeat measurement shows the 95th percentile falls to 0.41 milliseconds.
Synthetic case. Measurements are synthetic.
Errors and limits
Twenty samples describe one period; repeat at different times before concluding the budget is always met.
Exercises
- EX106 — Budget check. Is the 1.0 ms budget met in the lab, and how close is the tail? Rubric: 3 = met, max 0.95, p95 0.918;; 2 = met;; 1 = vague;; 0 = none.
- EX107 — Slow sample cause. What caused the slow sample and what fixes it? Rubric: 3 = connection burst at backup start, stagger;; 2 = backups;; 1 = vague;; 0 = none.
- EX108 — Growth trigger. Why trigger a review when rule count rises 20 percent? Rubric: 3 = more rules, more errors;; 2 = size;; 1 = vague;; 0 = none.
Synthesis
Measured latency and capacity show the design performs within budget with room to grow.
Continue studying — chapter 36 of 50
← Chapter 35 (draft) · Course chapter index · Chapter 37 (draft) →