DDoS Appliance Sizing: Gbps Is Not Enough

Most sizing conversations start in the wrong place. A vendor asks how much bandwidth you have, proposes a model rated near that figure, and the discussion moves to price.

That sequence skips the only question that determines whether the design works: how many packets per second can arrive at this device, and what happens when they do.

At a glance

Appliance	Number	Where it comes from	What it decides
Uplink capacity	Your transit contract	The hard ceiling on what can ever reach the appliance
Packet rate at that uplink	Arithmetic, at 64-byte frames	The rate the appliance must survive
Legitimate peak	Your own telemetry across a full business cycle	The floor beneath which thresholds must never sit
New sessions per second	Your own telemetry at peak	Whether a session-exhaustion attack has room to work
Growth horizon	Your own trend, not a vendor's	Headroom, and when the next capacity step lands
Failure tolerance	The business, in writing	Whether the design needs an upstream tier at all

Five of the six come from your own network. Only the last one comes from a conversation, and none of them comes from a product line.

Start with the ceiling you already own

Your uplink is a hard limit on the attack that can reach the appliance. Traffic beyond it is discarded by your provider’s equipment before it arrives, which means an on-premises device sized above the circuit is inspecting traffic that cannot exist.

This single observation removes most of the anxiety from the exercise. The appliance does not need to survive the largest attack ever recorded. It needs to survive a saturated version of your own circuit, and that is a specific, calculable number.

Convert the circuit into a packet rate

Every frame on Ethernet occupies its own length plus 20 bytes of interframe gap and preamble, so:

packets per second = bit rate ÷ ((frame bytes + 20) × 8)

At 64-byte frames a 1 Gbps circuit carries 1.488 million packets per second, 10 Gbps carries 14.88 million, and 100 Gbps carries 148.8 million. Those are the numbers to size against, because a device is exhausted by per-packet work rather than by bytes.

At maximum frame size the same circuits carry roughly eighteen times fewer packets. That eighteenfold gap is the entire reason bit-rate sizing goes wrong, and it is also why attackers send small packets. The capacity planner prints the conversion at every frame size with the arithmetic shown.

A device sized for the small-packet rate of your circuit cannot be overwhelmed by packet rate from that circuit. That is a strong and unusual guarantee, and it is available for the price of doing the arithmetic before the purchase rather than after.

Measure your legitimate peak, properly

The second number comes from your own telemetry, and it has to be measured over a full business cycle rather than a quiet week.

Record, at peak: bits per second, packets per second, concurrent sessions, and new sessions per second. Include the campaign launches, the month-ends, the results announcements — whatever produces your genuine maxima. A threshold set from an average week will refuse legitimate traffic the first time a real peak arrives, which is the most common cause of self-inflicted outages in this category.

The peak matters twice. It sets the floor beneath which no threshold may sit. And the ratio between it and the circuit ceiling tells you how much room an attacker has to work in before anything notices.

New sessions per second, which nobody records

Concurrent sessions is the number monitoring systems report and the number datasheets print. New sessions per second is the number a connection-exhaustion attack actually stresses, and most organisations have never measured it.

Get it before the sizing conversation. A device with an enormous session table and a modest session-establishment rate is exactly the shape of product that performs well in a demonstration and fails against a SYN flood, and you cannot detect that mismatch without knowing your own figure.

Growth, from your own trend

Published attack-size records are a poor sizing input. They describe what happened to an organisation whose circuit was far larger than yours, and traffic above your uplink is not your appliance’s problem in any case.

The useful growth input is your own: how your peak has moved over the past three years, plus whatever the business plans that will change it. From that, decide the headroom that makes the next capacity step a scheduled purchase rather than an incident. Whether that step is a licence change or a hardware change is a question with a large cost difference, covered in licensing models.

Where the upstream tier takes over

An appliance behind a saturated circuit is a bystander. No sizing decision changes that, and any product presented as solving it is being presented dishonestly.

So the division is clean. Everything that would fill the circuit belongs to the upstream tier — a transit provider’s filtering, a scrubbing arrangement, or the diversion mechanisms in scrubbing and RTBH. Everything that arrives belongs to the appliance. The trade-offs between those layers are worked through in cloud, on-premises or hybrid.

Once the division is written down, the on-premises sizing requirement reduces to one sentence: sustain the full small-frame packet rate of the circuit with mitigation active, without discarding legitimate traffic.

The sizing record

Six lines, written before any product is discussed:

1. Uplink capacity, per circuit, including any planned change.
2. Packet rate of that uplink at 64-byte frames.
3. Legitimate peak: bps, pps, concurrent sessions, new sessions per second, over a full cycle.
4. Growth horizon, from your own trend, with the year the next step is expected.
5. The division of responsibility between the upstream tier and the appliance.
6. What the business will tolerate: how long, how degraded, and what must never fail.

The sixth is the one that reduces cost most often. An organisation that can tolerate degraded performance for ten minutes on a non-critical service is buying a different design from one that cannot, and nobody asks unless the sizing document has a line for it.

Take that record into the tender and require the response to address it line by line. A supplier who proposes a model without seeing these six numbers has proposed a model, not a design.