# IoT IP Overlay Network Security Performance Analysis with Open Source Infrastructure Deployment
## 3 Components of Overlay Architecture  
This section introduces the currently most popular overlay implementations of Linux virtual interfaces, optionally using IPSEC for cryptography. In particular, the analyzed tunnels are:  
* _IPIP_: The IPIP tunnel is a method of tunneling that allows IP packets to be transmitted within another IP packet. This type of tunnel is primarily used to connect two internal IPv4 subnets across the public IPv4 Internet. Due to its minimal overhead, it is optimal for this application, although it only supports IPv4 unicast traffic and not multicast. Furthermore, the IPIP tunnel supports both IP over IP and MPLS over IP. * _VTI_: The Virtual Tunnel Interface (VTI) on Linux resembles Cisco's VTI and Juniper's secure tunnel implementation (st. xx). This tunneling driver facilitates IP encapsulations, compatible with XFRMi, to establish secure tunnels, enabling kernel routing atop. VTI tunnels function similarly to IPIP or SIT tunnels, with the addition of fwmark and IPsec encapsulation/decapsulation capabilities. * _GRE_ and _GREtap_: Generic Routing Encapsulation (GRE), defined in RFC 2784, involves inserting a GRE header between the inner and outer IP headers. Unlike IPIP, which is limited to encapsulating IP, GRE theoretically supports encapsulating any Layer 3 protocol with a valid Ethernet type. GRE tunnels can transport multicast traffic and IPv6. While GRE operates at OSI Layer 3, GREtap functions at OSI Layer 2, meaning there is an Ethernet header in the inner header. * _FOU_: Tunneling operates across different layers of the networking stack, with IPIP or GRE working at the IP level, and FOU (Foo Over UDP) functioning at the UDP level. Leveraging UDP tunneling offers numerous advantages, tapping into existing hardware infrastructure like RSS in NICs, ECMP in switches, and checksum offload. Performance boosts have been evidenced for IPIP protocols through developer patch sets. Currently, the FOU tunnel accommodates encapsulation protocols such as IPIP and GRE, with an example FOU header provided. Configuring an FOU receive port for IPIP entails setting it to port 5555, while for GRE, setting IP proto to 47 is required. Another command establishes a new IPIP virtual interface (FOU1) configured for FOU encapsulation, with the destination port set to 5555. * _GUE_: Generic UDP Encapsulation (GUE) is a form of UDP tunneling distinct from FOU. Unlike FOU, GUE features its encapsulation header, which includes protocol information and additional data. Setting up a GUE receive port for IPIP bound to 5555 involves configuring an IPIP tunnel for GUE encapsulation. Currently, the GUE tunnel supports inner IPIP and GRE encapsulation. An example GUE header is provided. * _GENEVE_: Generic Network Virtualization Encapsulation (GENEVE) consolidates the functionalities of VXLAN, NVGRE, and STT, aiming to address their perceived limitations. Many anticipate that GENEVE could ultimately supplant these earlier formats entirely. The GENEVE tunnel header closely resembles VXLAN, with the key distinction lying in its flexibility. The GENEVE header allows for easy integration of new features through extension with a new Type-Length-Value (TLV) field. * VXLAN: VXLAN (virtual extensible local area network) is a tunneling protocol designed to address the limitation of VLAN IDs (4096) in IEEE 802.1q. As described in IETF RFC 7348, VXLAN introduces a 24-bit segment ID, known as VXLAN Network Identifier (VNI), allowing for up to 24 (16,777,216) virtual LANs. This capacity is 4096 times that of traditional VLANs. VXLAN finds common deployment in data centers across virtualized hosts, often spanning multiple racks. It encapsulates Layer 2 frames with a VXLAN header into a UDP-IP packet. * _IP/MACVLAN_: MACVLAN enables multiple MAC and IP addresses on a single physical interface through MACVLAN sub-interfaces, unlike VLANs where sub-interfacesshare the same MAC address. Each MACVLAN sub-interface has a unique MAC and IP address, directly integrated into the underlay network.