Performance Analysis of Docker-based NFV Service Chaining Networks in a Single-Host Environment

Abstract

Network Function Virtualization (NFV) and Service Function Chaining (SFC) enable network functions to be deployed as Virtual Network Functions (VNFs) on flexible commodity servers. However, chaining multiple VNFs within a service chain may degrade data-plane performance, particularly in container-based environments. This study analyzes the performance of container-based SFC in a single-host Docker environment under three scenarios: (1) a direct client–server connection without VNFs (baseline), (2) the addition of a single Layer 3 (L3) VNF in the form of an iptables firewall, and (3) the integration of an L3 firewall VNF combined with a Layer 4 (L4) load balancer VNF based on HAProxy. Performance evaluation was conducted by measuring TCP throughput using iperf3, end-to-end latency using ping, and CPU utilization of each container using docker stats. The results indicate that adding the L3 firewall reduces throughput by approximately 33% and nearly doubles latency compared to the baseline. Meanwhile, incorporating the L4 load balancer causes throughput degradation of up to 92%. CPU utilization analysis shows that the kernel-space firewall introduces minimal additional overhead in user space, whereas the L4 VNF becomes the primary source of CPU saturation. These findings suggest that, in container-based SFC deployments on a single-host Docker environment, performance bottlenecks are primarily driven by user-space L4 VNFs rather than kernel-based L3 forwarding. Therefore, L4 VNFs require special consideration when designing service chaining architectures for resource-constrained edge nodes.