Firewall Throughput Sizing Calculator

Work out firewall throughput sizing instantly with clear inputs, formula shown and shareable results.

About Firewall Throughput Sizing Calculator

Firewall datasheets quote stateful throughput with large packets, which bears little relation to real performance with inspection enabled. Application control typically halves it, IPS reduces it to around 30 percent, and TLS decryption to nearer 10 percent. Packet size matters too, since per-packet processing dominates: small packets cut throughput proportionally.

Formula

Firewall derating

effective = datasheet x inspection factor x packet-size factor; factors ~ 1.0 stateful, 0.5 app control, 0.3 IPS, 0.12 TLS decryption

Worked example

With the default values below, Firewall Throughput Sizing Calculator returns Effective throughput with this profile of 6.00. Change any input above and every figure here is recalculated in your browser.

Inputs used

Required throughputminimum 0.001 Gbps: 5 Gbps
Inspection profileone of Stateful firewall only, Application control, Threat prevention with IPS, Full inspection with TLS decryption: Threat prevention with IPS
Datasheet firewall throughputminimum 0.001 Gbps: 20 Gbps
Average packet sizeaccepts 64–9,000 bytes: 700 bytes

Results

Effective throughput with this profile: 6.00 Gbps
Throughput lost to inspection: 70%
Utilisation at the required rate: 83.3%
Sizing assessment: Adequate for the required throughput

Step by step

1Values used
2Firewall derating
3Effective throughput with this profile= 6.00 Gbps
4Throughput lost to inspection= 70
5Utilisation at the required rate= 83.3
6Sizing assessment= Adequate for the required throughput

Assumptions and limits

The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Why is TLS decryption so expensive?

Every session needs asymmetric key operations plus full re-encryption, and the inspection engine must buffer and reassemble streams. It is the single largest performance cost in a modern firewall.

Which datasheet number should I trust?

The one measured with the feature set you will actually enable, using an enterprise traffic mix rather than large-packet UDP. Vendors publish both; only the former is useful.