nForce3-250 - Part 1: Taking Athlon 64 to the Next Level
by Wesley Fink on March 23, 2004 11:55 AM EST- Posted in
- CPUs
nForce3-250Gb: On-Chip Firewall
Frankly, it's a good feeling to be relatively safe behind a router in a network. Any security expert, however, will tell you that the big risk in recent days has come from infected email attachments that get through any router setup and are spread friend to friend or across a home network. Active LAN gamers also can pose high security risks because they often end up opening huge IP holes in their setup so they can play their games on-line. nVidia has tried to address these types of security risks with an on-chip firewall in nForce3-250 that can be easily configured in your internet browser.The nVidia Firewall is a hardware-optimized solution and an integrated component of nVidia nForce media and communications processors (MCPs). Currently, the nF3-250 chipset offers the on-chip firewall, but nVidia said that they also plan to incorporate the firewall into an upcoming revision to nForce2 Ultra 400. This on-chip design eliminates potential conflicts with third-party drivers, BIOS, or hardware. nVidia tells us that they are also working with Microsoft to make certain that their on-chip firewall is fully recognized and supported in Microsoft's upcoming firewall additions to the Operating System.
Because it is native, the nVidia Firewall eliminates many issues with software conflicts, improves throughput and protection, and lowers CPU utilization. This all sounds good, but we were most interested in how you configured nVidia's firewall, since current software firewalls that are effective are usually a nightmare to configure. Even those that try to be friendly can be a genuine pain to use in the training or "rule-setup" phase.
LAN Gaming
When you look closely at the nVidia firewall, it is clear that someone in the design group understood what was wrong with most firewalls. There are several predefined levels of protection, and the assumptions that were made in defining these levels are about the same as we would make in our own configurations. You define these simple setups in your browser, but what if you're a LAN gamer with 20 games, all requiring different ports for connection? Here, nVidia had you in mind because there are a whole group of predefined games with the corresponding ports. Configuring for your LAN game is as easy as checking the game in the setup or unchecking it when you want to close an access. This is really slick, and something you don't expect in a chipset!Anti-Hacking
The firewall also has some very interesting anti-hacking features. Most software firewalls can filter IP's just fine, but most have trouble with the kind of hacker attacks that we really see today. The hacker today most often uses a "zombie" PC generating spoofed packets, and the on-chip firewall is a hardware solution that is better able to protect against this type of hacker attack. As nVidia explains:"A spoofed IP packet has an illegally generated value in its IP Source Address field. By using an intentionally incorrect IP address, it is possible to build certain kinds of attacks. The most notorious is a distributed denial-of-service (DDoS) attack, which is also one of the most common types of attacks that use IP spoofing. These DDoS attacks depend on two things: 1) an Internet-connected "zombie" device, often a PC, that has been compromised; and 2) the ability to command the zombie PC to send packets with spoofed IP source addresses.
Firewalls have always been able to filter based on an IP address, but the detection of spoofed packets involves a more subtle distinction. For example, based on a given packet's IP source address, should that packet have arrived on the interface that received it, given what the firewall knows about the routing table? An intermediate device cannot easily detect that a given packet is spoofed.
The best approach to preventing spoofing is to block spoofed packets at their source - the zombie PCs. By embedding the anti-spoofing capability directly into the PC's networking hardware/software infrastructure, the PC is prevented from using any IP address other than its statically assigned address or its DHCP-assigned address."
Configuration
All the firewall capabilities available are next to useless if the configuration is inaccessible or overly complicated. The new nVidia on-chip firewall is configured through your browser.
Facebook
Twitter
RSS
71 Comments
View All Comments
Reflex - Tuesday, March 23, 2004 - link
Once again, the only person who said anything about gaming performance and dual CPU rigs in reference to today's environment is you, Prisoner. I fire up a game on my PC maybe once a month, so honestly buying ANY pc component for gaming reasons is more than a little rediculous in my case(thats what I have an Xbox for).However I have plenty of reasons to run dual CPU's, I mess around with making my own DVD's, occasionally I am known to compile a kernel, etc. These are becoming increasingly popular in the average home as well, especially with DVD recorders getting cheap and people wanting to convert those home movies.
As for games, my only point was that the installed base is being created now. I'd recon that at this point there are more HT compatible P4's sold than there are NV30 or R300 class and higher graphics cards on the market, and they are already developing games targetted for those platforms. All it really would take is Epic and id making their next generation engines more multi-threading friendly and you'd see mass adoption since those engines form the basis for a huge number of games. The potential for major increases in gaming performance is there, it just has not been tapped yet.
However, as I said, gaming is a relatively *minor* reason for dual CPU adoption. Believe it or not, most people don't do any sort of serious gaming on their PC, so it would really never be much of a selling point...
JADS - Tuesday, March 23, 2004 - link
#27 what is your obsession with games? Anyway my argument that dual CPU systems are highly relevant to enthusiasts stands and that has very little to do with games and more with multi-tasking and highly demanding applications such as video editing, image rendering, code compilation, server duties, etc...Anyway the gap between a dual and single CPU systems with regards to games really is quite small these days and mostly it is down to the board in question being focussed on stability and reliability rather than outright performance. I'm guessing you wouldn't want for games performance from a dual Athlon FX-53 system on an nVidia nForce3-250 chipset.
AMDfreak - Tuesday, March 23, 2004 - link
I'll be waiting for PCI Express versions too. It doesn't appear that the jump to A64 is going to give me enough of a speed increase over an OC'd Barton until I'm ready to replace my 9800 Pro anyway.truApostle - Tuesday, March 23, 2004 - link
all your base belong to themprisoner881 - Tuesday, March 23, 2004 - link
#24 and #25, the idea of buying "ahead of the curve" for technology has historically been a stupid, cost-ineffective idea. Buying a duallie system today (at mucho $$$) because you expect to find duallie-ready games in the next three to five years is just dumb use of your money. I say three to five years because that's how long it's going to be before gaming companies produce software that either demands dual CPU's or demands Hyperthreading. In the meantime, you'll have one very expensive processor on a very expensive motherboard just sitting around twiddling its thumbs. And by the time these games DO come out, both of your CPU's (and very likely your motherboard as well) will be obsolete. Such is the way of things.Now, one of you DID touch on a good reason to get a duallie system, namely if you're doing compute-intensive stuff like 3D rendering. I happen to do that for a living, and I've got 8 dual Athlon systems in a render farm. Much more cost effective than single CPU systems, but none of them will ever win any points in a gaming match.
agent2099 - Tuesday, March 23, 2004 - link
AC97 Audio? This is a step backwards from Nforce2. Where is the MCP-T?JADS - Tuesday, March 23, 2004 - link
#22 I didn't say specifically for games, I said enthusiast. A dual CPU system is inherently more flexible, be it compiling code faster, to rendering pictures quicker to multi-tasking using many apps. How many enthsiasts simply run one program at a time? I know I don't and could make use of a powerful dual CPU system.Dual CPU systems do not need to run with ECC/Registered memory although typically due to the target market this is a feature. Running a dual processor FX system with standard DDR memory could be a very fast and cost effective machine.
Reflex - Tuesday, March 23, 2004 - link
#22: I agree with you until you get to the part about 'never will'. HyperThreading is making developers consider making thier apps multi-threaded, and starting sometime next year multi-core CPU's will be introduced most likely. When most machines sold have the ability to process more than one thread at a time, it would be pretty stupid to ignore that factor.So for now, multiple CPU's is not that helpful for *gaming*, although it is for many other applications. In the future, however, I expect it to be very helpful for everything, including gaming.
Wesley Fink - Tuesday, March 23, 2004 - link
#4 -Ass-kissing has never been my forte. I consider myself an equal-opportunity offender. After finding none of the AGP locks worked on Round 1 chipsets, you better believe I would test for myself whatever I am told about the new boards.
Frankly I really like nF3-250GB, but I also hear good things about SiS 755FX for 939 (1200HT) and VIA's update for 939. After some of the crap we've had to endure with Round 1 chipsets, it will be nice to have some good Athlon 64 choices in Round 2.
prisoner881 - Tuesday, March 23, 2004 - link
#20, gamers that buy dual-CPU systems are just being stupid. Practically no game out there makes good use of more than one CPU, and none are planned. Add to that the overhead of having additional CPU's in the system, the cost of a dual system versus a single, and the slower memory (Reg'd ECC), and you've got a tremendous waste of money. I have *never* seen a dual-CPU game box outrun a single-CPU game box, and I doubt we ever will.