How Ideco Measures NGFW Performance Using TRex ASTF and RFC 9411 Methodology
Ideco has shared a comprehensive look at how its engineering team measures the performance of Ideco NGFW Novum on the Ideco EX platform. The article explains why raw performance numbers are meaningless without a clearly documented methodology and describes every parameter used in their lab tests.
Why Performance Numbers Vary Across Tests
The same NGFW device can produce very different results on two different test beds even when both tests are honest. Performance depends on packet size, enabled security functions, number of rules, test duration, and the acceptable loss threshold. Ideco therefore publishes its full methodology so that any reader can reproduce the measurements and understand exactly what each figure represents.
Traffic Generator and Test Modes
The team selected the open-source TRex generator running in ASTF (Advanced Stateful) mode. This choice enables realistic TCP session handling and L7 emulation, which is essential for testing stateful inspection engines. Stateless mode is used only for raw UDP throughput tests with 1518-byte frames. When TLS decryption is enabled on the firewall, the team switches to the hardware-based Keysight BreakingPoint system.
Test Bed Configuration
Both the device under test and the traffic generator use identical server hardware:
- CPU: Xeon Gold 6338N
- RAM: 128 GB
- NICs: Intel E810 2xQSFP28 (100 Gbps)
The topology is a simple two-port setup with TRex port 0 connected to the DUT and TRex port 1 returning the traffic.
Key Metrics and Traffic Profiles
The methodology measures four primary metrics: throughput in Gbit/s, connections per second (CPS), concurrent connections (CC), and latency. Tests are performed with the following profiles:
- UDP 1518-byte frames (raw L2/L3 ceiling)
- TCP/HTTP with 64 KB objects
- TCP/HTTP with 16 KB objects
- EMIX mixed corporate traffic
- TCP CPS and TCP CC specific tests
All tests run with a fixed set of firewall rules, IPS signatures, and application control profiles. TLS decryption remains disabled during these runs.
Loss Criterion and Test Duration
Loss is defined as dropped sessions rather than individual packets. The formula uses TRex counters for TCP connection drops, established session drops, and UDP keepalive drops. A test point passes only when session loss stays at or below 1 %. Each load point is held for 300 seconds after a 30-second ramp-up phase to reveal queue buildup, memory pressure, and thermal effects that short bursts would miss.
Results Summary
On the Ideco EX platform the measured maximums are:
- UDP 1518 B: 200 Gbit/s
- TCP/HTTP 64 KB: 100 Gbit/s
- TCP/HTTP 16 KB: 62 Gbit/s
- EMIX (firewall only): 92 Gbit/s
- EMIX + IPS: 31 Gbit/s
- Full NGFW stack: 15.5 Gbit/s
- TCP CPS: 800 000 new sessions per second
- TCP CC: 21 000 000 concurrent sessions
The article concludes that performance is always a range that depends on the actual traffic mix and enabled security functions. Full configuration files and commands are provided so the community can replicate the tests.
Related articles
OAuth Authorization Server Built Without Storing User Profiles
The article details the evolution of an OAuth Authorization Server that deliberately avoids storing user profiles, relying instead on external identity providers for authentication. It addresses three core constraints: hundreds of dynamically created isolated APIs, a public SPA client without a BFF, and the inability of resources to query the AS on every request. The design separates concerns so the AS handles only clients, tenants, grants, audiences, scopes, keys, sessions, and token issuance while the Main API owns profiles and roles. Tokens are managed securely inside a Service Worker using a custom FedCM grant, eliminating races across tabs and reducing XSS exposure. The approach minimizes blast radius, simplifies compliance, and keeps the AS replaceable without affecting product domain logic.
Why a 202-Character License Key Uses ECDSA P-256 Instead of Ed25519 or RSA
A developer building offline license verification for a .NET desktop application evaluated Ed25519, RSA, and ECDSA P-256 before selecting the last option. The decision was driven by the requirement for zero external dependencies, keys short enough for manual entry from email, and support for key rotation without breaking existing licenses. Although Ed25519 offers faster verification and a smaller public key, it is absent from System.Security.Cryptography in both .NET 8 and .NET 10, with API approval only targeted for version 11. RSA-2048 produces signatures too long for practical use, resulting in a 571-character Base32 string that users would find cumbersome. ECDSA P-256 with SHA-256 delivers a fixed 64-byte signature that becomes a manageable 202-character key when encoded in Base32, while remaining fully available in the runtime. The article also covers performance measurements, the risks of ECDSA nonce generation, and the deliberate choice of the IEEE P1363 signature format to guarantee fixed-length output.
Pilcrow Publishes Free Comprehensive Guide on Web Authentication
Author Pilcrow has released a detailed, ad-free handbook covering authentication and authorization practices for web applications. The resource draws on personal experience and includes practical examples in JavaScript and Go. It examines password-based methods, email verification, multi-factor authentication, passwordless flows, and passkeys while highlighting associated risks and usability trade-offs. The book also provides in-depth guidance on session management, token security, expiration policies, and email address handling as account identifiers. Recommendations emphasize choosing methods that match application security requirements and user expectations. Additional context is given on OWASP resources and community support channels.
redb 3.4.0 Adds Replay Checkpoints, Shared Runtime Layer and Declarative Secrets Handling for .NET Ecosystem
redb 3.4.0 delivers operational improvements for the .NET integration platform that includes typed storage over Postgres, MSSQL and SQLite, the redb.Route engine modeled after Apache Camel, the Tsak runtime with dashboard and clustering, and redb.Identity for OIDC and OAuth 2.1. The release focuses on post-deployment resilience with replay checkpoints that capture message state at named points inside routes, allowing safe re-execution of downstream steps without duplicating side effects. A shared runtime layer moves framework assemblies into a separate Libs/shared directory so that individual DLLs can be replaced without rebuilding or redeploying the entire Tsak or Identity packages. Secrets are now declared with a [Sensitive] attribute on endpoint options, ensuring URIs containing passwords or keys are sanitized before they reach logs, metrics or health checks. Additional controls include role-based access to management APIs, persistent audit trails and cryptographic signing of dynamically loaded modules. All Pro features remain free on the entire 3.x line with no licensing server required.