## 4 Experimental Results
### Upgraded Design for Data Throughput of 10 Gb/s  
Simulations were carried out to evaluate the feasibility of upgrading the proposed firewall design to work at the higher data throughput of 10 Gb/s. In the case of this higher data throughput, the hardware designed in the FPGA programmable logic was interfaced with the Ethernet SFP/SFP+ connector using the Xilinx IP module 'AXI 10G/25G Ethernet Subsystem' that replaced the 'AXI 1G/2.5G Ethernet Subsystem' module used in the 1 Gb/s firewall. Two different clock signals were generated from the 200 MHz KC705 oscillator using the Xilinx IP 'Clock Wizard': a 156.25 MHz clock used for the circuits devoted to the packets' transmission/reception and analysis (CLK_156.25 MHz), and a 10 MHz clock used for the communication with a PC through the USB-UART interface (CLK_10 MHz).  
The signal waveforms during a simulation are reported in Figure 14, where four different packets (of 60 bytes in size) were received at Port A and processed: a UDP packet, a TCP packet and two ARP packets. The 'AXI 10G/25G Ethernet Subsystem' module transfers the received packet to the designed hardware in the FPGA programmable logic using a 64-bit AXI communication protocol. The 64-bit data bus PORT_A_RX_DATA[63:0] is valid when the signal PORT_A_RX_DV is set. During the transfer of the last 64-bit word of  
Figure 12: Data throughput of TCP and UDP packets from Port A to Port B during the access to different websites.  
Figure 13: Data throughput of TCP and UDP packets from Port B to Port A during the access to different websites.  
data, the signal PORT_A_RX_LAST is set and the 8-bit control bus PORT_A_RX_KEEP[7:0] defines how many bytes of the 64-bit data bus PORT_A_RX_DATA[63:0] are valid.  
The 'Packet analysis' module is implemented using a combinational circuit working on a 64-bit word (FW_DATA[63:0]) for each clock cycle and calculates the same packet identification fields of the 1 Gb/s firewall with a latency of zero clock cycles: the MAC destination address (MAC_DEST[47:0]), the MAC source address (MAC_SOURCE[47:0]), the network layer protocol (LEV3_PROTOCOL[15:0]), the IP source address (IP_SOURCE[31:0]), the IP destination address (IP_DEST[31:0]), the transport layer protocol (LEV4_PROTOCOL[7:0]), the source port (SOURCE_PORT[15:0]) and the destination port (DEST_PORT[15:0]).  
When the signal FW_OUT is set, the 'Check firewall rules' module exploits the packet identification fields calculated by the 'Packet analysis' module to check if the received packet complies with the firewall rules. In the case of the 10 Gb/s data throughput, however, a severe constraint is present on the maximum number of clock cycles that can be used to check the compliance of the packet with the firewall rules. Considering a packet size of 64 bytes as a case study, the number of clock cycles available between two consecutive packets is 64 in the case of the 1 Gb/s firewall and 8 in the case of the 10 Gb/s firewall. Thus, the maximum number of rules for each firewall port was decreased from 256 (in the case of the 1 Gb/s firewall) to 32 (in the case of the 10 Gb/s firewall). The packets were checked against the firewall rules, and the results in Figure 14 show how, among the four received packets, the UDP packet, the TCP packet and the second ARP packet complied with the firewall rules (FW_RESULT[1:0] = 3) and were transferred to the 'AXI 10G/25G Ethernet Subsystem' module of Port B to be transmitted, while the first ARP packet presented an error (FW_RESULT[1:0] = 0) and was discarded.  
Overall, these preliminary simulations show promising results on the feasibility of upgrading the designed firewall hardware on an FPGA to work at a data throughput of 10 Gb/s. Future activities on this research project will implement the upgraded design  
Figure 14: Waveforms of the signals during the packets processing steps in the case of the firewall for the higher data throughput of 10 Gb/s.  
on the KC705 development board, and experimental measurements will be carried out to evaluate the system performance.