4

I need help with this: If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s?

Let's say I can send (Packet / Second - 64Byte) 450,000, meaning I would not only have 230.4 Mbps? So why is the maximum throughput limit is 1Gbps? I found it in: https://www.cisco.com/c/dam/global/th_th/assets/docs/seminar/ASA5500_X.pdf

Stateful Inspection throughput (max1): 1Gbps Packets/Second (64-byte) 450,000

PS (Note): 64Byte * 450,000 = 28800000 Byte = 230,4 Mbps (megabits per second)

I don't understand how Cisco works, is this a marketing move?

8

If i have 1Gb/s throughput. I can receive how many pps in 64Byte each packet / s?

This is dependent on the platform. The more packets that must be processed in software, the fewer this will tend to be.

So for things like switches that may be entirely processed in hardware, this could be more than a million pps. For a router, this may be lower. For a firewall, IDS/IPS, application delivery controllers (aka ADCs or load balancers) or shaping platform that must process packets in some more detailed way, this will be even lower.

Some of these devices will have specialized hardware to help improve performance, for example many ADCs will have some sort of hardware SSL/TLS processing capability. In some cases, you can choose to process even that traffic in software (for example, if the hardware doesn't support the desired TLS ciphers). When you process the traffic through software instead of hardware, the performance loss can be significant (in some platforms, over 99%).

I don't understand how Cisco works, is this a marketing move?

Yes, and no. Clearly marketing is at play to some degree, Cisco or any other vendor wants to sell customers on their product. They all do it in varied ways and to varying degrees. You may (or may not) see throughput/performance numbers in a number of ways.

Anyone can say their device has 1G interfaces, or that it has 1 Gbps throughput. But the question is then, "under what conditions?" Max length packets? With which (if any) features enabled? If those conditions change, how does that affect performance?

More than likely in an enterprise, you will have a list of requirements (i.e. x throughput, y PPS, and z concurrent sessions, n ACL lines, etc). When you go to choose a platform, you need to choose the platform that meets or exceeds those requirements. Or you may provide decision makers with options (#1 meets all requirements, #2 meets x and z but costs a% less than #1, and so on).

Vendors may provide a lot of information that is overwhelming to understand for new customers, or they may try to omit information that is less favorable in comparison to other vendors. Learning to sift through the information provided and ask the right questions for the environment is a skill one needs to learn when purchasing larger scale hardware.

In the Cisco document you reference, Cisco provides a number of different pieces of information to help you determine which platform would best meet the needs of your environment. This information is important, but always remember that it is still incomplete and not likely match your environment perfectly. Make sure to understand both your environment's needs and what this information gives or doesn't give you.

  • Let's say I want to sell 1 Link Full Duplex (Fiber), I could not say it's 1Gbps Full, if the equipment is 1Gb thgroput, if the software that is contained in the equipment can not handle x simultaneous connections with more or less 64Bit / s each request? In the above example (Packet / seconds - 64Byte: 450k) could I sell 1 internet link claiming to be 1Gb Full or would I have to buy 1 equipment that supports larger band to claim "1Gb Full Duplex"? I'm sorry for the repetitions, my English is a bit bad, I'm using Google Translate – LUCAS PAIXÃO SOARES RIBEIRO Jan 3 at 21:27
  • Not sure I understand what you are asking, but I;ll give it a try. Say you have a device that can provide 1 Gbps throughput if all the packets had the same source and destination (i.e. one simultaneous connection). You could say it is capable of 1 Gbps throughput without mentioning the condition, as that is technically a true statement. You also won't have happy customers. Another thing you may want to note is that throughput of a device is often a combined number, so to support 1 Gbps full duplex, you may need a device that can handle 2 Gbps of throughput (1 Gbps inbound and 1 Gbps outbound). – YLearn Jan 3 at 21:40
  • So usually to support and provide 1Gb Full Duplex, without caring about the number of packages (in 1Gb size) I have to buy 1 equipment that meets such demand. That is, if I want pure 1Gb, that supports indefinite packages relative to their sizes, eg: "Packet (40Byte)/s: 3.125.000 Packet (160Byte)/s: 781,250 Packet (xByte)/s: x" I will need to buy 1 equipment with higher capacity even if I do not have the link of 2 or more Gb to provide dedicated link to my customer with quality. It's possible to manipulate the Software, such as BPF / XDP, to save money and provide a good customer service? – LUCAS PAIXÃO SOARES RIBEIRO Jan 4 at 0:02
6

The ethernet standard for 1 Gbps means that the ethernet interface can serialize frames at 1 Gbps. What you are seeing is the limitation of the device to process packets. That depends on many factors, including the CPU speed. Basically, the firewall software is slower than the interface hardware speed.

This is something to check whenever you are researching hardware (all vendors, not just Cisco). Firewalls depend a lot on software to inspect the packets, and software will be slower than hardware. You can also run into this with routers, but switching is something that can be done almost completely in hardware, so wirespeed switching is common. The problem you may run into with switches is the backplane speed.

The vendors need to explain the ethernet standard used by the interfaces (10/100 Mbps or 1/10/40/100 Gbps), but that doesn't mean that the software of the device can process that fast, which is why you look at the pps (among other things), which can also vary greatly by the services enabled. For example, encryption/decryption can greatly slow a device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.