How to Read a DDoS Appliance Datasheet Without Being Misled

A datasheet is a marketing document written by engineers, and the tension between those two facts explains almost everything about how it fails a reader. The engineers put in real measurements. The document puts the largest of them first. Nobody lies, and a buyer still ends up specifying a device that will be saturated by an attack the specification said it could handle.

What follows is not a warning to distrust vendors. It is a list of the substitutions that happen between a measurement and a purchase order, with the arithmetic that undoes each one.

At a glance

Appliance	The figure	The question it answers	The question you were asking
Throughput, in Gbps	How much data the device moves at a frame size it chose	How many packets it inspects before it starts dropping
Maximum capacity, family level	What the largest model in the range does	What the model on the quotation does
Concurrent sessions	How large the state table is	How fast new sessions can be created
Attack types blocked	Which names appear in the feature list	Which of them still work at your packet rate
Latency	The delay added at a load the vendor chose	The delay added while mitigating

None of the left-hand figures is dishonest. Each answers a narrower question than the one it appears to answer, and the gap between the two columns on the right is where a specification goes wrong.

The substitution that causes most of the damage

Datasheets lead with bit rate because circuits are sold in bit rate. Mitigation devices fail on packet rate, because the work they do is per packet.

The conversion is fixed by Ethernet and worth carrying in your head. Every frame on the wire is followed by a 12-byte interframe gap and preceded by 8 bytes of preamble and start delimiter, so a frame of n bytes occupies n + 20 bytes of wire time:

packets per second = bit rate ÷ ((frame bytes + 20) × 8)

At the 64-byte minimum, a 10 Gbps circuit carries 14.88 million packets per second. At the 1,518-byte maximum it carries about 813,000. Same circuit, same bit rate, eighteen times the workload. A device advertised at 10 Gbps has been advertised at whichever of those two numbers the manufacturer measured, and it is not usually the hard one.

This is not a hypothetical gap. Volumetric attacks tend toward small packets precisely because small packets buy more work per unit of bandwidth. Specifying on bit rate is specifying for the traffic pattern an attacker has no reason to send.

The capacity planner prints this conversion at every frame size, including the arithmetic, so that a figure can be checked rather than trusted.

Family figures and the box on the quotation

Product ranges are marketed as ranges and sold as units. A headline capacity attaches to the range, which means it describes the largest member.

The gap between the top and bottom of a single appliance family is commonly an order of magnitude. A buyer who reads the range figure, budgets for the entry model and specifies against the headline has built a design with a factor of ten in it, and the error will not surface until the first serious attack.

Ask for the figure for the model on the quotation, in writing, with the frame size stated. This is a routine request and the answer is usually available immediately.

Generation drift

The trap that is hardest to see is the one where the document is fine and simply old.

Manufacturers refresh hardware faster than they refresh websites. A public specification page can describe a superseded platform for years after the current one shipped, and the figures on it may be several times lower — or, less often, higher — than what is being quoted. Both directions cause damage. A buyer comparing a current quotation from one supplier against a stale public page from another is not comparing products at all.

The check is quick: ask which platform generation the figures describe, and when the document was last revised. A manufacturer whose public material lags its product should be able to say so plainly, and one who cannot say which generation a number belongs to has told you something about how the number was produced.

Sessions: two different numbers wearing one label

“Concurrent sessions” and “new sessions per second” measure unrelated things, and the first is the one datasheets print because it is larger and easier.

Concurrent sessions describes the size of the state table — how many conversations the device can hold at once. New sessions per second describes how quickly entries can be created, which is what a connection-exhaustion attack actually stresses. A device holding fifty million concurrent sessions may still be brought down by an attack that opens sessions faster than it can install them, and the datasheet’s large number says nothing about that ceiling.

If only one figure is available, the useful one is the second. The mechanism is the subject of SYN proxy and SYN cookies, and the state economics are worked through in the stateful paradox.

Direction, and what was counted

A figure of 10 Gbps might mean ten in, ten out, or ten in total. An inline device sees both directions; a device deployed asymmetrically may see only one. The same hardware therefore carries two legitimate ratings, and datasheets do not always say which is printed.

The question is one line: is that unidirectional or bidirectional, and does it include the return path? Where the answer is bidirectional and your deployment is symmetric, halve the figure before it enters a design.

What the licence caps and what the hardware does

Capacity is often a licensing construct. The same chassis ships with a throughput licence that can be raised by purchase, which means a datasheet may print the hardware ceiling, the licensed ceiling, or both without distinguishing them.

This matters twice. It matters at purchase, because the quoted price may cover a fraction of the printed number. It matters again during an incident, because a licence ceiling reached under attack is not something a support call resolves in the ninety seconds available. Establish which figure is licensed, what raising it costs, and how long it takes to apply — the last of those being the one that is never asked and always relevant.

Interfaces are not capacity

A specification listing thirty-two 10-gigabit ports is describing connectivity, not mitigation. Port aggregate exceeds processing capacity on nearly every device in this category, for the sound reason that ports are cheap and inspection is not.

Read the interface list as a statement about how the device fits into a topology and nothing more. The capacity figure is a separate line, and where the two are printed adjacently without comment, the adjacency is doing persuasive work the text does not claim.

Latency, and the load it was measured at

Latency figures are usually real and usually measured on an idle device. The number a buyer needs is the added delay while the device is mitigating at a substantial fraction of its rated capacity, because that is the condition under which latency matters to an application.

For most estates this figure is not decisive and does not need to be argued about. For trading systems, real-time gaming and voice it is decisive, and in those cases it is worth measuring rather than reading — under attack, on your own traffic, at your own packet rate.

Feature lists and the word “blocked”

A list of attack types a device blocks is a statement about implemented functions. It is not a statement about efficacy, and it is definitely not a statement about efficacy at load.

Every product in this category lists SYN floods, UDP floods, reflection and amplification, application-layer floods. The lists converge because the attacks are well known and the countermeasures are well documented — the mitigation techniques section covers most of them, and none belongs to any manufacturer. What separates products is the packet rate at which each countermeasure still works, the false-positive rate it produces on real traffic, and the operator effort it takes to tune. None of that is in the list.

Read the list to confirm nothing is missing. Read nothing else into it.

Test conditions, and their absence

The strongest signal in any datasheet is whether test conditions are stated at all.

A specification that names the frame size, the direction, the traffic mix and whether mitigation was active while measuring is describing a real measurement made by people who expect to be checked. One that prints a single unqualified number is describing a marketing position. The difference is visible in seconds and predicts a great deal about how the rest of an evaluation will go.

RFC 2544 remains the reference convention here: a frame-size matrix from 64 bytes upward, measured to the point of loss. Nothing obliges a DDoS vendor to use it, and asking whether their figures follow it is a reasonable and revealing question.

What to put in writing

Six lines, and they belong in the specification rather than the conversation:

1. The capacity figure for the specific model quoted, in packets per second, at 64-byte frames, with mitigation active.
2. Whether that figure is unidirectional or bidirectional.
3. New sessions per second, not only concurrent sessions.
4. Which ceilings are licensed rather than physical, the cost of raising each, and the time to apply.
5. The platform generation the figures describe and the date of the document.
6. Added latency while mitigating at half the rated capacity.

Answers to these six turn a datasheet into a specification. What they cannot do is establish false-positive behaviour, multi-vector behaviour or degradation under dependency loss, which is the work of a proof of concept and cannot be delegated to a document.

The honest reading

Most of the figures discussed here were produced honestly and describe real capabilities. The purpose of reading carefully is not to catch anyone out; it is that a datasheet is written to be persuasive to a general reader and you are a specific one, with a packet rate, a frame-size distribution and a deployment topology that the document could not have known.

The comparison across products becomes possible only after each figure has been converted back to the same conditions. The vendor dataset on this site does that conversion where the source material allows it, and marks the fields where it does not — which is more of them than a reader might expect.