# IoT IP Overlay Network Security Performance Analysis with Open Source Infrastructure Deployment
## 5 Implemented Scenarios and Experimental Results
However, if the workload primarily consists of small messages, larger MTU sizes will not have a significant impact. It is advisable to use the largest MTU size supported by both the adapter and the network. For example, on ATM adapters, the default MTU size of 9180 bytes is much more efficient than using an MTU size of 1500 bytes, which is commonly used by LAN Emulation. Figure 2.0 Clustered RTT distribution trend for the central tunnels group number 2 illustrated in Figure 2.1

Figure 2.2 Clustered RTT distribution trend for the central tunnels group number 3 illustrated in Figure 2.3

In Gigabit and 10 Gigabit Ethernet networks, if all machines have Gigabit Ethernet adapters and no 10/100 adapters are present, it is best to use jumbo frame mode. For instance, connections from server to server within a computer lab can typically be optimized using jumbo frames. MTU, or maximum transmission unit, is also known as link MTU. Measured in bytes, it is the maximum packet size that can be sent in one piece over a hop without being fragmented. It differs from path MTU (PMTU) which is the minimum MTU of the hops in a path. In the presence of packet loss, the path MTU discovery process can generate an underestimation for the MTU. One way to verify the discovered MTU is to re-run the test a couple of times to see if the result is consistent. That said, the fact that the discovered MTU is associated with a known standard suggests that it is not an accidental underestimation. Common values for MTU are shown in Figure 2.4

The overhead introduced by various tunneling protocols varies depending on the specific protocol and configuration. Focus on overlay links deployed is shown in Figure 2.5 These overheads should be considered when designing and implementing network tunnels, as they affect the overall payload size and network performance. When using a tunnel interface over IPsec, the overhead consists of the IPsec headers, the outer IP header for IPsec, and the additional IP header for tunnel encapsulation. The IPsec header includes the IPsec Security Association (SA) information, encryption and authentication headers (if used), and any additional IPsec-related metadata. The IPIP encapsulation adds another IP header, which includes the source and destination IP addresses of the tunnel endpoints, as well as any additional IP options. The total overhead for a tunnel over IPsec is the sum of the IPsec and tunnel type headers, along with any additional IPsec overhead. This overhead varies depending on the specific IPsec configuration (encryption, authentication algorithms, etc.) and the tunnel type configuration. To provide a specific overhead, you would need to analyze the IPsec and tunnel configurations in use. Generally, IPsec overhead can range from tens to hundreds of bytes, while the IPIP, for example, header adds 20 bytes. In LibreSwan, the default MSS (Maximum Segment Size) for both tunnel mode and transport mode is typically calculated based on the MTU. For tunnel mode, where the default MTU is typically 1400 bytes, the MSS would be set accordingly. MSS is typically calculated as MTU minus the size of the IP and TCP headers. In IPv4, the IP header is typically 20 bytes and the TCP header is also 20 bytes. Therefore, for a 1400-byte MTU, the MSS would be 1360 bytes For transport mode, where the default MTU is often the interface's default MTU (usually 1500 bytes), the MSS would again be calculated similarly and is 1460 bytes. These calculations are based on typical IPv4 header and TCP header sizes. The MSS value can be influenced by factors such as any additional headers, options, or extensions present in the packet, but these calculations provide a general guideline for determining the MSS in LibreSwan based on the default MTU values. Each protocol has its strengths and trade-offs, making them suitable for various network configurations and requirements.