Solved

Throughput

Posted on 2002-03-20
11
581 Views
Last Modified: 2010-04-17
I have heard someone said this Firewall has a throughput to 1.5 Gigabytes. What does it mean ?  Please clarify me.

Thanks in advances.
0
Comment
Question by:leumas
  • 3
  • 2
  • 2
  • +4
11 Comments
 
LVL 11

Expert Comment

by:geoffryn
ID: 6883716
It generally means that the interface on the firewall is capable of passing and inspecting 1.5 gb/sec of traffic.  The figure is usually mis-leading however.  It usually only applies to the firewall in a single rule configuration and with a specific packet size.  It does not indicate real world performance.
0
 
LVL 8

Expert Comment

by:scraig84
ID: 6883940
I agree with the last statement - however I will say that they may be referring to the overall throughput of the box - not a single interface.  In other words the aggregate total of all traffic from all interfaces equals 1.5 gigabytes.  This would especially be true if it is truly 1.5 gigabytes and not gigabits as there is no interface that transfers at 1.5 gigabytes - that would be a 12Gb interface (or a 6Gb interface at full duplex)!!  Switches are typically rated at their ability to pass traffic accross all interfaces as well - but a more commonly used benchmark in the switching world is packets per second (PPS).
0
 
LVL 17

Expert Comment

by:mikecr
ID: 6887568
Just an FYI, firmware firewalls or SOHO type have higher thruput than software based like Checkpoint Firewall 1 on NT. They are normally faster at stateful inspection.
0
 
LVL 16

Expert Comment

by:SteveJ
ID: 6889492
Also . . . manufacturers will sometimes use their backplane bus speed as a "throughput" value and this can be extremely misleading, especially in a switch doing ATM or LANE.

I know I'm opening myself up for attack but my experience is that the old Bay routers/switches were about the only products that quoted a RELIABLE throughput value.

Steve
0
 
LVL 8

Expert Comment

by:scraig84
ID: 6889496
I think Bay sucks personally - but that's only because I know very little about them..
0
Highfive Gives IT Their Time Back

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 17

Expert Comment

by:mikecr
ID: 6889534
Never used them so I have no opinion.
0
 
LVL 16

Expert Comment

by:SteveJ
ID: 6889559
What the weasel kind of comment is that, scraig84? I don't suppose you are a VIKINGS FAN are you?

Actually, Bay products don't create suction but Bay product support creates enough suction to pull your eyes out of their sockets if you are unfortunate enough to have to deal with them.

But I digress . . .

Sorry leumas.
0
 
LVL 8

Expert Comment

by:scraig84
ID: 6889725
Nobody understands me...  Least of all Cowboy fans.

0
 
LVL 4

Accepted Solution

by:
jwalsh88 earned 5 total points
ID: 6897514
just to add my stupid 2 cents, usually when fw vendors are talking throughput they are referring to how much data can be sent through the fw, meaning comes in one interface, gets inspected or whatever the fw does, and gets sent out the other interface.  Now as far as comments on speed I work with 3 different brands of fw's, netscreen, PIX, and Checkpoint.  And make no mistake about it, an IBM server cluster with Dual Xeon Pentium III's running linux and Checkpoint NG with it's performance pack and load balancing high availability is the fastest fw/vpn device there is and at a lower cost then the high end netsreen's or PIX's.
I have never heard of adding up the througput of all the fw's interfaces like you might with a switching device on fw's so I assume he means 1.5 Gbits /sec.  which is a claim alot of vendors make.  Checkpoint claims they have seen almost 3 Gbits /sec on the above mentioned configuration.  you will never see anything like this.  But it's not that far off and is always a good indicator of traffic handling.  Not necessarily speed though.  realize there are alot of fw's that could easily handle close to the same traffic they just don't come with available Gigabit interfaces.  when you have all Fast ethernet interfaces you will never get more then 200 Mbps of throughput.  Thats what all of my fw's get but we know that can handle more as they have the same hardware.  So without using the Gigabit interfaces on the fw's you will not get a faster performance out of them.  An example is the Nokia line.  There top 3 fw's have almost identical performance on identical interface types but the upper lines have availability for more interface flexibility including 1000 Mbps interfaces.  So, be careful on what you buy and/or are talked into.  Make sure you need it.  Unless you have something above a DS3 line to the internet or have heavy traffic going from internal network to internal network through the fw, a middle of the road stateful packet inspection fw will be fine.  Something that can handle 200 Mbps of throughput should suffice.  I have 4 sites with dual DS3's at each one.  We use dual Nokia IP440's at each one and they aren't even hitting a fraction of their potential.

I think I have said enough
0
 

Author Comment

by:leumas
ID: 6913299
Thanks so much
0
 
LVL 1

Expert Comment

by:Computer101
ID: 7349720
jwalsh,
I have a question for you here.

Computer101
E-E Admin

http://www.experts-exchange.com/Networking/Q_20265226.html
0

Featured Post

Find Ransomware Secrets With All-Source Analysis

Ransomware has become a major concern for organizations; its prevalence has grown due to past successes achieved by threat actors. While each ransomware variant is different, we’ve seen some common tactics and trends used among the authors of the malware.

Join & Write a Comment

In a WLAN, anything you broadcast over the air can be intercepted.  By default a wireless network is wide open to all until security is configured. Even when security is configured information can still be intercepted! It is very important that you …
While it is possible to put two routes in place with the secondary having a higher metric, this may not always work. In the event of a failure that does not bring down the physical interface on the router the primary route is not removed. There is a…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now