% open flow

\subsubsection{Definition}

Open Virtual Switch, sometimes abbreviated as OVS, is an open-source implementation of a distributed virtual multilayer switch. The main purpose of Open Virtual Switch is to provide a switching stack for hardware virtualization environments, while supporting multiple protocols and standards used in computer networks~\cite{ovs}.
OVS was born to be a forwarding device, but its data representation is similar to Iptables' one, in which each entry has a list of fields to be match and an action to be performed on the packet, so the idea is to use this feature to transform the OVS in a stateless packet filtering.

The test is built to be a stress-test, that simulates different situations, from the one with lowest security requirements, that implements few filtering rules, to the highest critical security environment. To pretend these circumstances the performance estimation is computing with the following number of rules: [0, 10, 100, 250, 500, 750, 1000, 1500, 2000, 3000, 4000, 5000, 6000, 7000, 8000, 9000, 10000].

This is done exploiting the following bash script that receive the number of rules as parameter in input and it sets ``\code{\$1}'' number of rules on ``ovs-ID'' virtual switch, where the rules drops all the tcp packets with ``\code{\$i}'' destination port and coming from ``port-ID'' switch port.

\begin{figure}
	\HRule
\begin{lstlisting}[numbers=left,stepnumber=1, style=Bash]
#!/bin/bash

num=$(($1+39999))

for i in seq 40000 $num; do
  if [[ $i -ne 22 ]] && [[ $i -ne 5201 ]] && [[ $i -ne 80 ]];then
    docker exec "ovs-ID" ovs-ofctl add-flow br-int in_port="port-ID", dl_type=0x0800, nw_proto=6, tcp_dst=$i, actions=drop
  fi
done

exit
\end{lstlisting}
	\HRule
\end{figure}

\subsubsection{Latency test}

The following graph shows that the ovs latency performance is more or less constant with little perturbations due to the non complete isolation of the system.

\begin{figure}[H]
	\centerline{\includegraphics[width=\textwidth]
		{latex_files/pdf/ovs_rtt.pdf}}
	\caption{Latency test report for Iptables}
	\label{fig:ovs-rtt}
\end{figure}
\newpage

\subsubsection{Bandwidth test}

The following graph shows that the ovs bandwidth performance is more or less constant with little perturbations due to the non complete isolation of the system.

\begin{figure}[H]
	\centerline{\includegraphics[width=0.82\textwidth]
		{latex_files/pdf/ovs_bandwidth.pdf}}
	\caption{Latency test report for Iptables}
	\label{fig:ovs-bandwidth}
\end{figure}

\subsubsection{CPU consumption}

The following graph shows that the ovs CPU consumption performance is more or less constant with little perturbations due to the non complete isolation of the system.

\begin{figure}[H]
	\centerline{\includegraphics[width=0.82\textwidth]
		{latex_files/pdf/ovs_cpu.pdf}}
	\caption{Latency test report for Iptables}
	\label{fig:ovs-cpu}
\end{figure}

