redzilla
All tools
Performance

Firewall Sizing (PPS)

Enter the target throughput and packet size (or IMIX) and I compute the packets per second the firewall must handle, plus the memory for concurrent sessions and the new-connection rate.

The bidirectional traffic the device must inspect (layer 1/2 included in the frame).

Simple IMIX = 7×64 + 4×570 + 1×1518 ÷ 12 = 353.83 B. The 64 B case demands the most pps.

sessions
B/session

Each connection-table entry holds state. Typical ≈ 300 B; higher with deep inspection or NAT.

cps

Design figure: the rate at which new sessions are set up. It is a separate firewall limit from the data-plane pps.

Examples
redzilla.cl — fw-size
 
PPS at this size
PPS worst case · 64 B
Ethernet minimum (max load)
Session memory
PPS
PPS 64B
RAM
CPS

Diagnosis

PPS by packet size

Frame sizeppsMpps
How it is computed · pps, IMIX and memory

1. Packets per second: pps = throughput(bps) ÷ (packet_size_B × 8). A smaller packet ⇒ more packets for the same bandwidth.

2. The worst case is the minimum Ethernet frame (64 B): it demands the most pps. That is why vendors publish pps at 64 B.

3. IMIX simulates real traffic by mixing sizes: 7×64 + 4×570 + 1×1518 ⇒ average 353.83 B. It is a more representative load than 64 B alone.

4. Session-table memory: sessions × bytes_per_session. The new-connection rate (cps) is a separate limit: it measures how fast sessions are created, not the data volume.

Runs locally in your browser · no sign-up · nothing leaves your browser

How it works

The calculator converts a target throughput (kbps, Mbps or Gbps) into the packets per second a firewall or router must process, based on the chosen packet size: fixed values from 64 to 1518 bytes, a custom size, or the simple IMIX mix (7×64 + 4×570 + 1×1518 bytes, 353.83 B average). It also sizes the session-table memory and records the new-connections rate (cps) as an independent design limit.

The core formula is pps = throughput(bps) ÷ (packet_size × 8): for the same bandwidth, smaller packets demand more pps. That is why the worst case is the minimum Ethernet frame (64 B, IEEE 802.3), the value vendors use to publish maximum performance. State memory is estimated as sessions × bytes_per_session (typically ≈ 300 B per connection-table entry).

Example: 10 Gbps edge firewall with IMIX traffic

  1. With IMIX the average packet is 353.83 B: pps = 10,000,000,000 ÷ (353.83 × 8) ≈ 3.53 Mpps.
  2. The 64 B worst case rises to 10,000,000,000 ÷ 512 = 19.53 Mpps: that is the figure to compare against the vendor datasheet.
  3. With 1,000,000 concurrent sessions at 300 B each, the state table takes 300 MB of memory.

Frequently asked questions

How many pps does a firewall need for 1 Gbps?
It depends on packet size: at 1 Gbps that is about 82,000 pps with 1518 B frames, about 353,000 pps with IMIX, and 1.95 Mpps in the 64 B worst case. If the firewall only publishes throughput with large packets, it can saturate under real small-packet traffic (VoIP, DNS, attacks).
What is IMIX traffic and why is it used for sizing?
IMIX (Internet Mix) is a standard blend that mimics real internet traffic: 7 packets of 64 B, 4 of 570 B and 1 of 1518 B, averaging 353.83 B. It is more representative than testing only at 64 B or only at the MTU, which is why many vendors publish IMIX performance figures.
What is the difference between concurrent sessions and new connections per second (cps)?
Concurrent sessions measure how many connections the firewall keeps open at once and consume memory (≈ 300 B per session). Cps measures how fast new sessions are created and consumes CPU during setup. They are independent limits: a firewall can hold millions of sessions yet choke while creating 50,000 per second.
Does this calculator send my data to a server?
No. Everything runs in your browser: throughput, session and sizing data never leave your machine, so you can use it with internal network information without exposing it.
Was this tool useful?
Disclaimer We take great care to keep every tool accurate and review it thoroughly; even so, we can't guarantee it is free of errors or take responsibility for how the results are used. We recommend double-checking anything critical.
Found an error? Let us know →