← Back
Home › Systems › Security and identity

ngfw

next-generation firewall

Palo Alto, FortiGate, Check Point

SystemTechniques · 14Primitives · 70 ngfw Deterministic simulation testingdistributed · medium: Run the whole system in one thread under a seeded scheduler with simulated network, disk and clock, so every failure replays from its seed.›Primary-backup replicationdistributed · medium: One node orders all writes and ships them to standbys; the acknowledgement rule (none, one, all) sets what a crash loses, and an external arbiter decides who takes over.›Hot-standby redundancyembedded · medium: A second, always-current controller shadows the primary and takes over within a few cycles of silence; epochs stop the old primary from fighting back.›Packet classificationnetworking · medium: Multi-field rule matching (tuple space search, decision trees) and flow cachesLinear-time regular expression matc…search-sort · medium: Match a regular expression in O(pattern x text) worst case by tracking all live parse positions at once, then cache the state sets as a lazily built DFA for speed.›Coverage-guided fuzzingsecurity · medium: Mutate inputs, run an instrumented target, and keep any input that reaches a new code edge; feedback turns blind guessing into incremental search.›Tls interceptionsecurity · medium: Terminate and re-originate TLS with an on-the-fly CA for inspection; pinning and privacy limitsPacket header parsingnetworking · low: Parse graph state machines for Ethernet, IP, TCP and UDP headers in hardware and softwareTcam ternary matchingnetworking · low: TCAM ternary match tables: priorities, range expansion, power and capacity trade-offsAho-Corasick multi-pattern matchingsearch-sort · low: Find all occurrences of many fixed patterns in one pass over the text, in time independent of the pattern count, using a trie with failure links.›X509 certificatessecurity · low: Certificate chains, path validation, SANs, revocation and short-lived issuanceHdr histogramdata-structures · low: Log-linear bucketed histograms with bounded relative error for latency percentilesRadix triedata-structures · low: Compressed prefix tree for path routing, domain matching and prefix lookupsFpga packet processinghardware-os · low: FPGA/SmartNIC pipelines that parse packets and act in hardware for nanosecond tick-to-tradeProcess supervisionhardware-os · low: A parent process starts services, reaps their exits and restarts them under a delay and burst-limit policy, then stops them with SIGTERM before SIGKILL.›Connection trackingnetworking · low: Per-flow state table (5-tuple, TCP state, timeouts) for stateful packet handlingDeep packet inspectionnetworking · low: Classify flows by payload/SNI/protocol signatures for application-aware policyInternet checksumnetworking · low: Ones-complement IP/TCP/UDP checksum, incremental update (RFC 1624) and offloadIp fragment reassemblynetworking · low: Reassemble IP fragments with timeouts and overlap/DoS protectionKernel-bypass networkingnetworking · low: User space (DPDK, AF_XDP) or an in-driver eBPF hook (XDP) handles packets straight from NIC rings, skipping sockets, for 10-40 Mpps per core.›Longest prefix matchnetworking · low: IP prefix lookup structures (DIR-24-8, Poptrie, LC-trie) for routes, ACLs and geo-IPNetwork address translationnetworking · low: NAT mapping tables, endpoint-independent mapping/filtering, hairpinning and port allocationReceive side scalingnetworking · low: NIC hashing of flows to RX queues (RSS) and symmetric hashing for per-core processing+ 7 more techniques+ 54 more primitives

Similar systems

Share the most building blocks with this one.

forward-proxy 28 %mobile-core 28 %dns-authoritative 28 %sse-gateway 27 %enterprise-vpn 25 %