Size deep packet inspection in packets per second: per-packet CPU cycle budget, cores required and nanoseconds per packet.
Inspection cost is per packet, not per bit, so convert bandwidth into a packet rate first. Multiplying by the cycle cost of your pipeline gives the cycles per second you need, and dividing by the core clock gives the core count — a 2.5 GHz core delivers 2.5 billion cycles per second and nothing more. The nanosecond budget per packet is the number that kills designs: at 10 million pps you have about 100 ns per packet, which is roughly 250 cycles, and a single cache miss costs 100 of them.
Packet Inspection Capacity
pps = bits per second ÷ (packet size × 8); cores = ceil(pps × cycles per packet ÷ core clock in Hz).
pps = bits per second ÷ (packet size × 8); cores = ceil(pps × cycles per packet ÷ core clock in Hz). Inspection cost is per packet, not per bit, so convert bandwidth into a packet rate first. Multiplying by the cycle cost of your pipeline gives the cycles per second you need, and dividing by the core clock gives the core count — a 2.5 GHz core delivers 2.5 billion cycles per second and nothing more.
The nanosecond budget per packet is the number that kills designs: at 10 million pps you have about 100 ns per packet, which is roughly 250 cycles, and a single cache miss costs 100 of them.
This calculator takes 5 inputs: Throughput to inspect, Average packet size, CPU cycles per packet for inspection, Core clock, Cores allocated to the data plane. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because it is the worst case and attackers choose it deliberately. Dropping from 512-byte to 64-byte packets takes 40 Gbps from about 9.8 million pps to 78 million pps — an eight-fold increase in inspection work at identical bandwidth. Any device sized on an internet mix is trivially overwhelmed by a small-packet flood.