Methods and Systems of Information Protection, Information Security

LABORATORY ANALYSIS OF TCP ACLS AND INTERFACE METRICS IN A NETWORK TESTBED

N. M. Koval , E. A. Gimpel
UDC: 004.383.3 Published: 01.09.2026 Issue: Vol. 3 No. 011 (2026): Professionalitet, 2026 DOI: 10.24412/3033-9359-2026-011-36-43
Download PDF

Abstract

This paper presents a teaching-oriented analysis of network configuration fragments and the authors’ summary of interface measurements from a laboratory testbed. It considers Cisco Catalyst 2960, Eltex MES1428, and MikroTik CRS326. The objective is to relate the commands actually shown to the limits of aggregate-counter interpretation, without treating a counter change as verified filtering of a particular traffic flow. The Cisco and Eltex configurations deny TCP between two specified hosts and then permit other IP traffic; they do not impose a general IP-packet ban. The MikroTik fragments create a bridge and add interfaces, but show neither an ACL rule nor its attachment. The authors describe SNMP monitoring in Zabbix with a sixty-second polling interval. These measurements average traffic over the interval and cannot identify protocol composition or brief peaks. The reported before-and-after load values are retained, while derived ratios are recalculated from their rounded central values. These calculations characterize summary numbers rather than the proportion of packets actually forwarded. Raw time series and the calculation of the authors’ plus-or-minus quantities are unavailable, so their statistical interpretation is not established. The material supports discussion of TCP rules, interface attachment, and the distinction between configuration, aggregate observation, and evidence of a filtering effect. It does not compare vendors or establish the composition of residual load or hardware causes of differences.

Online viewer

References

  1. Cisco. Configuring IPv4 ACLs (разграничение IP ACL и MAC ACL) [Электронный ресурс]. – URL: https://www.cisco.com/c/en/us/td/docs/IIOT/switches/ie35xx/sw-config-guide/17-18/b_ie3500_1718-cg/configuring_ipv4_acls.html (дата обращения: 12.10.2026).
  2. Eltex. MES Series User Manual 10.4.2.1 (лимиты ACL для MES1428) [Электронный ресурс]. – URL: https://api.prod.eltex-co.ru/storage/upload_center/files/54/MES_Series_user_manual_10.4.2.1_en.pdf (дата обращения: 12.10.2026).
  3. Cisco. Configuring IPv4 Access Control Lists на Catalyst 2960L (software filtering при ограничениях аппаратных ресурсов) [Электронный ресурс]. – URL: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960l/software/15-2_7_e/configuration_guide/sec/b_1527e_security_2960l_cg/configuring_ipv4_access_control_lists.html (дата обращения: 12.10.2026).
  4. Cisco. Configure Punt/Inject and FED Packet Capture (определение punt в CPU) [Электронный ресурс]. – URL: https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-xe-gibraltar-16121/216746-configure-punt-inject-fed-packet-capture.html (дата обращения: 12.10.2026).
  5. MikroTik. L3 Hardware Offloading (ACL redirect-to-cpu и особенности offload) [Электронный ресурс]. – URL: https://help.mikrotik.com/docs/spaces/ROS/pages/62390319/L3%2BHardware%2BOffloading (дата обращения: 12.10.2026).
  6. MikroTik. Bridging and Switching (bridge traffic bypass firewall, use-ip-firewall) [Электронный ресурс]. – URL: https://help.mikrotik.com/docs/spaces/ROS/pages/328068/Bridging%2Band%2BSwitching (дата обращения: 12.10.2026).
  7. IETF. RFC 826: An Ethernet Address Resolution Protocol [Электронный ресурс]. – URL: https://datatracker.ietf.org/doc/html/rfc826 (дата обращения: 12.10.2026).
  8. ALT Linux Wiki Установка и первоначальная настройка ZABBIX [Электронный ресурс]. – URL: https://www.altlinux.org/Установка_и_первоначальная_настройка_ZABBIX (дата обращения: 12.10.2026).

License

Copyright (c) 2026 N. M. Koval, E. A. Gimpel (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

TCP ACL switch SNMP interface counter laboratory testbed