Blend plaintext and TLS-inspected traffic to find the real throughput an IPS delivers, in both bits and packets per second.
IPS capacity is not a single number: plaintext flows are inspected at the signature-set rate while decrypted flows run at the much lower TLS rate. Weighting the two by their share of traffic gives a blended figure, and dividing by the average frame size converts it into the packets per second the data plane must actually service. Most IPS deployments fail on the packet rate long before the bit rate, because small-packet traffic multiplies per-packet inspection cost while leaving the bandwidth graph looking comfortable.
IPS Throughput
effective = (plaintext share × rated × signature derate) + (TLS share × rated × TLS derate); pps = effective bits ÷ (packet size × 8).
effective = (plaintext share × rated × signature derate) + (TLS share × rated × TLS derate); pps = effective bits ÷ (packet size × 8). IPS capacity is not a single number: plaintext flows are inspected at the signature-set rate while decrypted flows run at the much lower TLS rate. Weighting the two by their share of traffic gives a blended figure, and dividing by the average frame size converts it into the packets per second the data plane must actually service.
Most IPS deployments fail on the packet rate long before the bit rate, because small-packet traffic multiplies per-packet inspection cost while leaving the bandwidth graph looking comfortable.
This calculator takes 6 inputs: Rated L4 throughput, Signature set, Share of traffic decrypted for inspection, Throughput remaining under TLS inspection, Peak offered load, Average packet size. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
It depends on the configured failure mode. Fail-open preserves availability by forwarding uninspected traffic, which is a silent security gap; fail-closed preserves security by dropping, which is an outage. Sizing with real headroom is how you avoid ever making that choice under pressure.