IPS Throughput Calculator
Blend plaintext and TLS-inspected traffic to find the real throughput an IPS delivers, in both bits and packets per second.
Inputs
Full decrypt/re-encrypt typically leaves 20–30% of rated throughput.
Blended Inspected Throughput
7.40Gbps
Utilisation at Peak Load
81.1%
Headroom
1.40Gbps
Inspected Packet Rate
1,321,429pps
Sizing Verdict
Tight — under 20% headroom
Step by step
Values used
Rated L4 throughput = 20 Gbps; Signature set = Balanced signature set (45%); Share of traffic decrypted for inspection = 40 %; Throughput remaining under TLS inspection = 25 %; Peak offered load = 6 Gbps; Average packet size = 700 bytes
IPS Throughput
effective = (plaintext share × rated × signature derate) + (TLS share × rated × TLS derate); pps = effective bits ÷ (packet size × 8).
Blended Inspected Throughput
= 7.40 Gbps
Utilisation at Peak Load
= 81.1
Headroom
= 1.40 Gbps
Inspected Packet Rate
= 1,321,429 pps
Sizing Verdict
= Tight — under 20% headroom
How it works
IPS capacity is not a single number: plaintext flows are inspected at the signature-set rate while decrypted flows run at the much lower TLS rate. Weighting the two by their share of traffic gives a blended figure, and dividing by the average frame size converts it into the packets per second the data plane must actually service. Most IPS deployments fail on the packet rate long before the bit rate, because small-packet traffic multiplies per-packet inspection cost while leaving the bandwidth graph looking comfortable.
Formula
IPS Throughput
effective = (plaintext share × rated × signature derate) + (TLS share × rated × TLS derate); pps = effective bits ÷ (packet size × 8).
- signature derate
- Fraction of rated throughput left with the chosen signature set
- TLS derate
- Fraction of rated throughput left when decrypting
Frequently Asked Questions
How is IPS Throughput calculated?
effective = (plaintext share × rated × signature derate) + (TLS share × rated × TLS derate); pps = effective bits ÷ (packet size × 8). IPS capacity is not a single number: plaintext flows are inspected at the signature-set rate while decrypted flows run at the much lower TLS rate. Weighting the two by their share of traffic gives a blended figure, and dividing by the average frame size converts it into the packets per second the data plane must actually service.
Why does IPS Throughput matter?
Most IPS deployments fail on the packet rate long before the bit rate, because small-packet traffic multiplies per-packet inspection cost while leaving the bandwidth graph looking comfortable.
What values do I need to enter?
This calculator takes 6 inputs: Rated L4 throughput, Signature set, Share of traffic decrypted for inspection, Throughput remaining under TLS inspection, Peak offered load, Average packet size. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
What happens when an IPS runs out of capacity?
It depends on the configured failure mode. Fail-open preserves availability by forwarding uninspected traffic, which is a silent security gap; fail-closed preserves security by dropping, which is an outage. Sizing with real headroom is how you avoid ever making that choice under pressure.
You might also need
- Firewall Capacity CalculatorCommonly used together
- IDS Capacity CalculatorCommonly used together
- Packet Inspection Capacity CalculatorCommonly used together
- SSL Inspection CalculatorCommonly used together
- Threat Detection Rate CalculatorCommonly used together
- Proxy Throughput CalculatorAlso in Network Security