## 5 Comparison with the State of the Art  
In this section, the features and the performance of the designed firewall hardware on an FPGA are compared with similar systems from the literature. In particular, a comparison is made among the firewalls presented in Section 2 that belong to the same category of stateless firewalls that analyze the packets using a set of rules without storing the status of the network connection. The main features of the considered firewalls are presented in Table 1.  
The proposed design was implemented on a KC705 development board that mounts the Kintex-7 XC7K325T-2 FFG900C FPGA. It can classify packets belonging to the protocols ARP, TCP, UDP and ICMP. For each port of the firewall, up to 256 rules can be defined to discriminate between safe and potentially dangerous packets according to a whitelist or blacklist approach. Before a decision is made on the compliance of the packets with the firewall rules, the packet data are stored in a 16 kB memory on the FPGA, and this allows the firewall to be operative almost 100% of the time. A set of statistics, such as the number of received packets, the number of allowed packets, the number of dropped packets and the memory occupation, are calculated in real time and can be downloaded to a PC using the USB-UART interface to detect potential anomalies in the network traffic. Experimental measurements have shown that the designed firewall features a very low latency (627 ns) and a data throughput of 0.982 Gb/s. Preliminary simulations have shown promising results that the design can be upgraded to work at a maximum data throughput of 10 Gb/s with minor modifications. Regarding the supported network protocols, the proposed firewall can classify packets that belong to the protocols ARP, TCP, UDP and ICMP, just like most of the compared systems [28; 29; 31; 34]. The system presented in Ref. [30] can only analyze packets belonging to the protocols TCP and UDP, and the experiments were only carried out on packets of a fixed size (512-bit). The performance of the system presented in Ref. [32] is not reported since this firewall was evaluated only by simulations and was not implemented on an FPGA device. The firewall presented in Ref. [33] was designed for the detection of cyber-attacks in 5G networks and thus also implements additional protocols for this type of network (TXLAN and GTP). Regarding the data throughput, the firewall presented in Ref. [33] achieves the best performance (3.67 Gb/s), while all the other systems presented in Table 1 feature a data throughput lower than the proposed firewall (0.982 Gb/s). However, based on the promising simulations presented in Section 4.3, we are confident that our system can be improved with a higher data throughput. Moreover, the firewall of Ref. [33] is characterized by a packet loss rate of about 2.5%, while our system is not operative for a negligible part of the time (3.29\(\cdot 10^{-5}\)%). \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**FPGA Device** & **Supported Protocols** & **Data Throughput** & **Latency** & **Reference** \\ \hline Xilinx Kintex-7 325T & ARP, TCP, UDP, ICMP & 0.8 Gb/s & 402 μs & [28] \\ Altera EP4 CE115F29 & ARP, TCP, UDP, ICMP & 0.95 Gb/s & 61.266 μs & [29] \\ Xilinx Spartan 6 & TCP, UDP (512 bit) & NA & NA & [30] \\ Altera Stratix II & ARP, TCP, UDP, ICMP & NA & 1.76 μs & [31] \\ EP2560F672C5 & NA & NA & NA & [32] \\ Xilinx and Altera devices & TCP, UDP, TXLAN, GTP & 3.67 Gb/s & NA & [33] \\ Xilinx Virtex-7 690T & ARP, TCP, UDP, ICMP & NA & NA & [34] \\ Xilinx Kintex-7 325T & ARP, TCP, UDP, ICMP & 0.982 Gb/s & 627 ns & This work \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of the performance for the designed firewall with other firewalls from the literature.