# IoT IP Overlay Network Security Performance Analysis with Open Source Infrastructure Deployment
## 5 Implemented Scenarios and Experimental Results
\begin{table}
\begin{tabular}{l l} \hline \hline
**MTU Type** & **MTU Size (bytes)** \\ \hline IP over SONET & 4470 \\ \hline Ethernet Jumbo Frames & 9000 \\ \hline IP over ATM Ethernet Jumbo Frames & 9180 \\ \hline Classic Ethernet & 1500 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Common MTU values by link type. First of all, it can be noticed that _Tinc_ shows very bad performance and following are some of the reasons why Tinc VPN may experience low performance:

* An MTU that is too high or too low can cause packet fragmentation or inefficiency in packet transfer. A value of 1400 can improve performance. * If compression is enabled, it can cause extra CPU load. * Suboptimal TCP/IP parameters can affect performance. * Using outdated versions of Tinc can lead to performance issues, and Tinc has not been updated since 2021. In both cases, Tinc connections are completely unsuitable. In the UDP cases, there are no differences in terms of bandwidth, while for Layer 4 TCP sockets, OpenVPN, OpenConnect, VTI, Nebula, XFRMi are unsuitable (very low reachable bandwidth), and WG, FOU, GUE, IP in IPspec, VXLAN IPsec and GREtap IPsec performance are comparable to the performance obtained with a Clean connection. The other tunnels outperform the previous ones. ### KVM Vs Containers, Strengths and Weakness

The work focuses on analyzing OVERLAY technologies within open source platforms, specifically using LibreSwan for implementing VPNs in a user-transparent manner. It plans to include a comparative analysis with VPNs in future research and deviates from traditional Docker networks to use KVM for creating more robust VM ecosystems. This approach leverages the power of modern hardware to address needs where containers alone may fall short. KVM (Kernel-based Virtual Machine) offers robust isolation and security by running full operating systems in VMs, which minimizes the risk of issues spreading between them. It supports a wide range of applications and tools, and provides flexible resource configuration and compatibility with modern hardware virtualization technologies. However, KVM VMs experience higher overhead and slower startup times due to the need to run a full guest operating system. Additionally, resource management with KVM is less dynamic compared to containers, potentially leading to inefficiencies in environments with fluctuating workloads. Docker containers are resource-efficient and start up quickly since they share the host operating system's kernel and do not require a full OS. They offer portability, making it easy to deploy applications across different environments, and provide good process-level isolation. However, containers have limited isolation compared to VMs, as they share the \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Tunneling Protocol** & **Header Type** & **Header Size (bytes)** &
\begin{tabular}{l} **Max Header Size** \\ **(bytes)** \\ \end{tabular} \\ \hline
**IPIP** & IP & 20 & 20 \\ \hline
**VTI** & IP + VTI & 20 + 4 & 24 \\ \hline
**GRE** & GRE & 4 + [0...34] & 38 \\ \hline
**GREtap** &
\begin{tabular}{l} Ethernet Frame + \\ GRE \\ \end{tabular} & 14 + 4 & 18 \\ \hline
**FOU** & UDP + IP & 8 + 20 & 28 \\ \hline
**GUE** & UDP + GRE & 8 + 4 + [0...34] & 46 \\ \hline
**GENEVE** & UDP + IP + GENEVE & 8 + 20 + 10 & 38 \\ \hline
**VXLAN** & UDP + IP + VXLAN & 8 + 20 + 8 + [0...16] & 52 \\ \hline
**MACVLAN** &
\begin{tabular}{l} Ethernet Frame + \\ MACVLAN \\ \end{tabular} & 14 + 4 & 18 \\ \hline
**MACsec** &
\begin{tabular}{l} Ethernet Frame + \\ MACsec \\ \end{tabular} & 14 + [8...30] & 44 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Size of the headers of the analyzed tunnel protocols and types of headers used. host kernel, which can pose security risks. Additionally, containers are constrained by the host kernel, limiting the ability to use different operating system configurations and complicating security management. Table 6 provides a summary of the comparison between the strengths and weaknesses of KVM and Docker platforms.