Performance

Firewall Sizing (PPS)

Enter the target throughput and packet size (or IMIX) and I compute the packets per second the firewall must handle, plus the memory for concurrent sessions and the new-connection rate.

Target throughput

The bidirectional traffic the device must inspect (layer 1/2 included in the frame).

Packet size

Simple IMIX = 7×64 + 4×570 + 1×1518 ÷ 12 = 353.83 B. The 64 B case demands the most pps.

Concurrent sessions

sessions

Memory per session (state)

B/session

Each connection-table entry holds state. Typical ≈ 300 B; higher with deep inspection or NAT.

New connections/sec (cps, optional)

cps

Design figure: the rate at which new sessions are set up. It is a separate firewall limit from the data-plane pps.

Examples

redzilla.cl — fw-size

PPS at this size

—

PPS worst case · 64 B

—

Ethernet minimum (max load)

Session memory

—

PPS —

PPS 64B —

RAM —

CPS —

Diagnosis

—

PPS by packet size

Frame size	pps	Mpps

How it is computed · pps, IMIX and memory

1. Packets per second: pps = throughput(bps) ÷ (packet_size_B × 8). A smaller packet ⇒ more packets for the same bandwidth.

2. The worst case is the minimum Ethernet frame (64 B): it demands the most pps. That is why vendors publish pps at 64 B.

3. IMIX simulates real traffic by mixing sizes: 7×64 + 4×570 + 1×1518 ⇒ average 353.83 B. It is a more representative load than 64 B alone.

4. Session-table memory: sessions × bytes_per_session. The new-connection rate (cps) is a separate limit: it measures how fast sessions are created, not the data volume.

Runs locally in your browser · no sign-up · nothing leaves your browser

Was this tool useful?

Disclaimer

We take great care to keep every tool accurate and review it thoroughly; even so, we can't guarantee it is free of errors or take responsibility for how the results are used. We recommend double-checking anything critical.

Found an error? Let us know →