\section{Conclusions and future improvements}
This Section discusses some conclusions of using a DPF, and possible
improvements or other avenues of research that may be of interest that
have been discovered during the development of the DPF.

\section{Conclusions}
The DPF can be used to enhance the network security of several hosts.
The enhanced security is done in one single point, which means that
the overall security of an entire intranet is enhanced in one step.
The DPF is also in contrast of using proxying services,
transparent for the users on the
intranet, which means that no existing software has to be modified.
 The DPF is also very easy to maintain for the system
administrator, with some luck he don't have to do anything at
all. Even so, the system administrator should have a good knowledge
about how the DPF works in order to use it in the most effective
way. 

The Linux operating system has been a very interesting research
system, and I know there are several other universities that are using
Linux for various research topics. The main benefits of Linux is that
it is free, runs on cheap PC's and has good performance. Before I
decided to use Linux I was evaluating the Solaris 2.4 operating
system. Solaris also runs on PC hardware. Linux was however faster on
the same hardware, and a wider range of hardware can be used.

If Linux is used for research in the future on UCCS, the overall
network security must be maintained. In order to maintain and setup a
Linux system, certain things has to be run as root. This might be
considered to be a security risk. There is also the possibility of when
changing the kernel, some bug is introduced and the network might be
flooded with packets that should not be there. The easiest way would
be to use a physically separated segment for the Linux research
computers (or any other operating system as well). 
However, if using Linux that might not be a good idea as most of the currently
available Linux documentation is found using the www, and thus some
network access is almost a must. The best solution
would be to connect the research computers on a separate segment like
above, but allow the users of the research computers to access the 
UCCS backbone in a restricted manner. The restriction can be enforced 
by setting up another Linux computer running PF/DPF as a router
between the research network and the UCCS backbone. The routing
computer should be kept in a locked room and only be maintained by a
professor or a trusted student. The root password of the computer used
for routing should be a different one than the password used on the research
computers. The above described setup would allow students 
to have root access to a powerful Unix platform without the risks.

\section{Improvements}
From the benchmarks of the DPF, the performance should be
improved. Currently the DPF keeps track of both outgoing and incoming
packets using the same list of DPF entries. That is perhaps not a good
idea. By trying to find the entry of an incoming packet before an
outgoing one, the current benchmarks could probably be improved as well.

The make the PF/DPF easier to maintain for the system administrator it
would be nice if all rules could be more easily maintained in a graphical
environment.

Documentation about how to setup and maintain a PF/DPF system would
also be nice. The current documentation of the Linux PFs is not very
good, and understanding of how everything is supposed to work has taken
a lot of time.

\section{Other research areas}
The Linux kernel needs a good documentation before it becomes
easier to improve parts of it. Documentation seems to be coming
though, I have seen advertisements for a German kernel guide. Even
though I can read some German, I would prefer an English version.

The netperf program is also supposed to be able to measure how busy
the host under investigation is. This did not work. Setting
up netperf to use variable packet sizes using TCP did not either
work. UDP worked fine, and all the benchmarks were run using UDP.


%%% Local Variables: 
%%% mode: latex
%%% TeX-master: "main"
%%% End: 
