Abstract
The overall performance of a firewall is crucial in enforcing and administrating security, especially when the network is under attack. The continuous growth of the Internet, coupled with the increasing sophistication of the attacks, is placing stringent demands on firewall performance. Under such circumstances it becomes very vital to understand the fundamental behind firewalls and their operation. In this paper, we describe a simulation framework for the study and analysis of firewalls. Based on this framework, we design methodologies to inspect and analyze both multi-dimensional firewall rules and traffic logs information. The data used for this study was collected over a large set of firewall rules and traffic logs at tens of enterprise networks managed by a Tier-1 service provider. The analysis presented in the paper firmly state the importance of considering traffic information in the process of firewall optimization. To the best of our knowledge ours is the first attempt to show the relevance of considering traffic characteristics to aid firewall optimization.