Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let me qualify that I am a developer so I may be naive. I have a program that requires TCP communication on our local network and the box does not need to be secure. I have had some API vendors in the past recommend that I shut off the BFE Service as it is unnecessary in our aforementioned case. Nevertheless, our admin is concerned with the risks. What are the risks of having it on or off? I need reliable TCP. I do not trust BFE and Windows Firewall.

share|improve this question
5  
box does not need to be secure since it is already behind a firewall - WRONG! 1. Firewall can be broken. 2. Some of the most damaging attacks will come from the inside of your network. –  Zoredache Feb 6 at 16:22
    
Most trading/low latency type firms do not use a firewall on hosted space. Moreover, this did not answer my question. Let's pretend my box does not need to be secure. Can someone explain to me if it is okay to turn off BFE? What are the repercussions? Please no self-indulgent comments. I am seeking to be educated. –  jimbouki Feb 6 at 17:20
3  
My questions would be what is it about BFE and WFP that you don't trust? These are pretty well tested, and industry understood, systems. Do you not trust the packet processing subsystem or do you not trust the administrator? Those are very different problems with very different solutions. –  Scott Pack Feb 6 at 17:21
    
I prefer to bypass any security/packet processing subsystem. In my industry, were latency is very important, we are one of two firms I know of that uses MSFT OS for its Order Management System. Everyone else uses Linux. The other MSFT OMS strongly recommends BFE to be shut off. I am trying to understand why. This is my main question??? My admin's answer regarding turning off BFE was too vague. He said it was too risky but never explained why. I need to know why. Especially in my case. That is why I reach out to the admins on ServerFault. What are the pros and cons of BFE? –  jimbouki Feb 6 at 17:41
1  
I apologize that MSFT is not used in my industry -- then why are you asking a question about Windows Server? Just for giggles? You obviously do use it...so why even say that? –  TheCleaner Feb 6 at 20:29

1 Answer 1

The risks in turning it off are:

  • Windows Firewall cannot operate
  • Unpredictable behavior and event logging from other components and applications that may assume that Windows Filtering Platform is operating normally.
  • No IPsec

A prime example of "other components and apps" that use/need the WFP in various ways would be antivirus. But I'll hazard a guess that you aren't using AV either. :)

Can you technically run without it? Yes. Can it improve network performance in certain scenarios? Yes. Is it generally recommended to turn it off? No.

You're trading off security and functionality for less processing overhead.

Read more about it here: http://msdn.microsoft.com/en-us/library/windows/desktop/aa363967(v=vs.85).aspx

Edit: Stealing this graphic from MSDN because it's cool:

Windows Filtering Platform

share|improve this answer
    
Don't need Firewall and IPSec. It is the "other components and applications" in your second bullet point that I am vague about. Also, I am trying to understand why a vendor would recommend it to be shut off for their low-latency api? There must be a reason. –  jimbouki Feb 6 at 18:14
    
@jimbouki A prime example of "other components and apps" that use/need the WFP in various ways would be antivirus. But I'll hazard I guess that you aren't using AV either. :) –  Ryan Ries Feb 6 at 18:18
    
This is from the vendor:"Keep in mind, that if BFE remains on, you will have performance degradation as noted above while testing X_TRADER with Microsoft." forums.tradingtechnologies.com/… –  jimbouki Feb 6 at 18:19
1  
The forum link you posted @jimbouki is about someone trialing software (you?) and it not working out, despite the moderator stating that nobody else has this issue and to call in for support. And the OP even stated the unwillingness to disable BFE (which contradicts your lackadaisical attitude towards security here). Maybe that 3rd party software isn't the way to go...simple enough. –  TheCleaner Feb 6 at 20:34
1  
+1 for excellent network stack architectural overview and link. @jimbouki: you have been provided with all the info one could wish for as to BFE overall design, which should answer most of your question. If you seriously don't trust the architecture yet are dependent on Windows you should consider writing your own drop in net stack substitute or risk coming across as opinionated but poorly informed. If you need performance data then you should benchmark on your specific plattform. –  ErikE Feb 6 at 21:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.