Packet Inspection Capacity Calculator
Size deep packet inspection in packets per second: per-packet CPU cycle budget, cores required and nanoseconds per packet.
Inputs
An internet mix averages roughly 400–700 bytes; 64 bytes is the worst case.
Packet Rate to Inspect
9,765,625pps
Cores Required
10
Data Plane Utilisation
61.0%
Packet Rate per Core
1,000,000pps
Time Budget per Packet
102.40ns
Cycles Required per Second
24,414,062,500
Step by step
Values used
Throughput to inspect = 40 Gbps; Average packet size = 512 bytes; CPU cycles per packet for inspection = 2,500 cycles; Core clock = 2.50 GHz; Cores allocated to the data plane = 16 cores
Packet Inspection Capacity
pps = bits per second ÷ (packet size × 8); cores = ceil(pps × cycles per packet ÷ core clock in Hz).
Packet Rate to Inspect
= 9,765,625 pps
Cores Required
= 10
Data Plane Utilisation
= 61.0
Packet Rate per Core
= 1,000,000 pps
Time Budget per Packet
= 102.40 ns
Cycles Required per Second
= 24,414,062,500
How it works
Inspection cost is per packet, not per bit, so convert bandwidth into a packet rate first. Multiplying by the cycle cost of your pipeline gives the cycles per second you need, and dividing by the core clock gives the core count — a 2.5 GHz core delivers 2.5 billion cycles per second and nothing more. The nanosecond budget per packet is the number that kills designs: at 10 million pps you have about 100 ns per packet, which is roughly 250 cycles, and a single cache miss costs 100 of them.
Formula
Packet Inspection Capacity
pps = bits per second ÷ (packet size × 8); cores = ceil(pps × cycles per packet ÷ core clock in Hz).
- cycles per packet
- CPU cycles the inspection pipeline spends on one packet
- time budget
- Nanoseconds available per packet before the queue backs up
Frequently Asked Questions
How is Packet Inspection Capacity calculated?
pps = bits per second ÷ (packet size × 8); cores = ceil(pps × cycles per packet ÷ core clock in Hz). Inspection cost is per packet, not per bit, so convert bandwidth into a packet rate first. Multiplying by the cycle cost of your pipeline gives the cycles per second you need, and dividing by the core clock gives the core count — a 2.5 GHz core delivers 2.5 billion cycles per second and nothing more.
Why does Packet Inspection Capacity matter?
The nanosecond budget per packet is the number that kills designs: at 10 million pps you have about 100 ns per packet, which is roughly 250 cycles, and a single cache miss costs 100 of them.
What values do I need to enter?
This calculator takes 5 inputs: Throughput to inspect, Average packet size, CPU cycles per packet for inspection, Core clock, Cores allocated to the data plane. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is 64-byte traffic the number that matters?
Because it is the worst case and attackers choose it deliberately. Dropping from 512-byte to 64-byte packets takes 40 Gbps from about 9.8 million pps to 78 million pps — an eight-fold increase in inspection work at identical bandwidth. Any device sized on an internet mix is trivially overwhelmed by a small-packet flood.