Tool
DDoS capacity planner
A circuit rated in gigabits per second is also rated in packets per second, and the second number is the one most defences actually run out of first. This converts one into the other at each frame size, so a capacity requirement can be written in the unit an attacker will use.
Your circuit
With JavaScript disabled these inputs do nothing — use the reference table below, which is generated at build time and covers the common circuit sizes.
Figures update as you type. The arithmetic is printed below so the result can be checked by hand.
Packet rate at line rate, by frame size
Each cell is the packet rate that fully occupies that circuit with frames of that size. A device rated only in gigabits has to be checked against the leftmost column, because that is what a packet-rate attack sends.
| Circuit | 64 B | 128 B | 256 B | 512 B | 1024 B | 1518 B |
|---|---|---|---|---|---|---|
| 1 Gbps | 1.49 Mpps | 845 kpps | 453 kpps | 235 kpps | 120 kpps | 81 kpps |
| 10 Gbps | 14.88 Mpps | 8.45 Mpps | 4.53 Mpps | 2.35 Mpps | 1.20 Mpps | 813 kpps |
| 25 Gbps | 37.20 Mpps | 21.11 Mpps | 11.32 Mpps | 5.87 Mpps | 2.99 Mpps | 2.03 Mpps |
| 40 Gbps | 59.52 Mpps | 33.78 Mpps | 18.12 Mpps | 9.40 Mpps | 4.79 Mpps | 3.25 Mpps |
| 100 Gbps | 148.81 Mpps | 84.46 Mpps | 45.29 Mpps | 23.50 Mpps | 11.97 Mpps | 8.13 Mpps |
The arithmetic
On Ethernet each frame carries 20 bytes of overhead that are not part of the frame itself: a 7-byte preamble, a 1-byte start-of-frame delimiter and a 12-byte interpacket gap. So for a frame of N bytes:
packets per second =
bit rate ÷ ((N + 20) × 8)At 10 Gbps with 64-byte frames that is 10 000 000 000 ÷ 672 ≈ 14.88 million packets per second — the figure quoted as line rate for 10 gigabit Ethernet, which is a useful check that the formula above is the conventional one.
Assumptions and limits
- Ethernet framing. Other media have different overhead.
- The figures are ceilings at line rate, not a prediction of any particular attack. An attacker does not have to reach line rate to exhaust a device.
- Headroom is applied to your stated normal peak. It does not account for growth between now and the end of the contract, which belongs in the same conversation.
- No vendor figures are used anywhere in this tool. Compare the result against the datasheet for the specific model you are quoted, in packets per second at a stated frame size.
- Nothing here changes the ceiling itself: a defence behind a saturated circuit is not helped by being correctly sized.
What to do with the number
Put it in the requirement. A specification that says “must sustain 10 Gbps” can be met by a device that collapses at two million packets per second; one that says “must sustain 14.88 Mpps at 64-byte frames with stated goodput” cannot. The proof-of-concept methodology turns that requirement into a test, and the capacity versus efficacy distinction explains why the packet-rate figure alone still does not tell you whether the device decides correctly.