A good packets-per-second value is not a universal number. It is a relationship between your measured peak, expected growth, packet-size mix, enabled features, and a capacity limit tested under comparable conditions. This guide shows how to measure those inputs and turn “it depends” into a defensible router, firewall, switch, server, or cloud-VM decision.
📅 Published: July 21, 2026 | 🔄 Last reviewed: July 29, 2026
✓ Fact-checked: metric definitions and Ethernet limits against
Cisco; benchmark principles against
RFC 2544; measurement guidance against operating-system and cloud-provider documentation ·
methodology
The Quick Answer: Good PPS Means Capacity With Evidence
A good PPS level is a projected peak that remains below your feature-on tested capacity at the utilization target you selected. It should also remain stable enough that packet loss, queueing, latency, CPU, and provider allowance counters stay within your operating objectives.
This definition avoids two common mistakes: treating a random internet “normal PPS” range as a standard, and comparing live Layer 3 counters with a 64-byte Layer 2 datasheet benchmark as if they measured the same thing. Use the PPS calculator for bandwidth, frame-size, and wire-overhead math; use this page for measurement, interpretation, and planning.
PPS Baseline and Headroom Planner
Enter a measured peak, growth assumption, tested device capacity, and the maximum utilization you are willing to plan for.
%
Planning result
Fits selected target
Projected peak uses 32.5% of tested capacity.
Projected peak65 Kpps
Required capacity at target92.857 Kpps
Capacity ÷ projected peak3.08×
Unused tested capacity135 Kpps
Planning aid only. The result is only as comparable as your live counter and test: match traffic direction, packet size, feature set, software version, and loss criteria.
How to Measure Your PPS Baseline
A baseline should capture normal busy periods, not one idle snapshot. Record received and transmitted packet rates, packet-size distribution where possible, CPU, drops, errors, queueing, and latency. Keep ingress and egress separate until you know whether the device rating is one-way or aggregate.
Linux
Live interface packet rates:
sar -n DEV 1
rxpck/s and txpck/s are received and transmitted packets per second. Cumulative counters are also available with ip -s link show.
macOS
Show interval statistics for an interface; replace en0 as needed:
netstat -I en0 -w 1
For cumulative interface counters, use netstat -ib. The Linux ip -s link command is not native to macOS.
Track discards, errors, queue length, CPU, interrupts, and DPC activity at the same time.
Routers, switches and SNMP
Use native interface graphs when available. For monitoring, take the delta of high-capacity packet counters over the sample interval. Include unicast, multicast, and broadcast counters when they matter, and handle counter resets or wrap correctly.
A useful collection window
1. Sample at a consistent short interval during the busiest hours for at least one representative week.
2. Keep median, 95th percentile, and actual peak rather than relying only on a daily average.
3. Mark deployments, backups, scans, incidents, and known traffic events so legitimate peaks are explainable.
4. Re-baseline after a major policy, topology, workload, firmware, or instance-size change.
How to Read a Router, Switch or Firewall PPS Rating
“2 Mpps” is not a complete specification. Ask the following before comparing it with your baseline:
Questions to ask when interpreting a device packet-rate specification
Question
Why it changes the answer
Which frame sizes were tested?
Minimum frames maximize PPS; large frames maximize bit throughput. A mixed workload falls between them.
Is the number one-way or aggregate?
Adding ingress and egress to compare with a one-direction rating—or not adding them for an aggregate rating—creates false utilization.
Which features were enabled?
Forwarding-only results may not represent NAT, IPS, VPN, TLS, QoS, logging, or application inspection.
What loss and latency criteria ended the test?
A device can keep forwarding while loss or delay has already made the service unacceptable.
Is it per port, line card, or system?
Shared backplanes, fabrics, CPUs, and licenses can make the system limit lower than the sum of ports.
Are state and application limits published?
Load balancers and firewalls may hit connections/s, concurrent sessions, TLS, or transaction limits before PPS.
RFC 2544 is a benchmarking methodology, not a guarantee that every vendor result is directly comparable. The closest evidence is a test of your exact hardware, software, policy, packet mix, direction, and acceptance criteria. Use the calculator's device-capacity check only after you have that comparable rating.
What “Good PPS” Means in Different Environments
Home and small-office routers
Many products omit feature-on PPS ratings. Measure the actual peak and watch CPU, latency, errors, and drops during packet-heavy events. The link's 64-byte line rate is a hard upper bound, not proof the router can forward it.
Firewalls and load balancers
Packet rate is only one axis. Size for feature-on PPS, new connections/s, concurrent sessions, TLS or inspection throughput, and the failure behavior of the application behind the device.
Switches and routers with ASIC forwarding
Verify whether the switching fabric is non-blocking for the populated port configuration and whether services or exception traffic leave the hardware path. A line-rate claim should be checkable against port count and minimum-frame Mpps.
Cloud VMs and virtual appliances
Instance size, virtual NIC path, provider shaping, connection tracking, CPU, and offloads matter. Use provider-specific counters rather than assuming unused Gbps means unused network capacity.
Cloud examples with documented signals
AWS EC2: ENA exposes pps_allowance_exceeded, bandwidth allowance, connection-tracking, and link-local allowance metrics. A rising counter identifies shaping or drops for that specific allowance.
Azure: Accelerated Networking uses SR-IOV to bypass the host virtual switch, which Microsoft documents as providing lower latency, higher PPS, lower jitter, and reduced CPU utilization on supported configurations.
How to Diagnose a PPS Bottleneck
PPS alone does not prove a bottleneck. Build a timeline and look for several signals changing together:
Packet loss or interface discards rise while traffic approaches a repeatable packet rate.
Latency or queue depth rises even though bit-rate utilization is not close to the link ceiling.
CPU, interrupts, softirqs, or DPC activity track packet rate more closely than byte rate.
Provider or NIC counters identify PPS, bandwidth, connection-tracking, or resource allowance exhaustion.
Reproduce the behavior with controlled tests across multiple frame sizes and the real feature set. If the failure rate stays roughly constant in PPS while achieved Mbps changes with frame size, that supports a per-packet processing limit. If the failure stays near one bit rate, the link or throughput path is more likely. If neither is stable, investigate state, connections, application transactions, buffers, or another shared resource.
PPS as a DDoS Signal
Attackers can use small packets to maximize per-packet work before filling a link. That is why DDoS telemetry commonly reports both Gbps and Mpps. But there is no universal attack PPS threshold: a legitimate traffic event can be large, and a smaller attack can overwhelm a limited device.
Alert on context: change from baseline, packet-size distribution, protocol and flag mix, source and destination concentration, new connections, failed handshakes, drops, latency, and infrastructure limits. A baseline-derived alert should trigger investigation, not automatically label traffic malicious. Rate limiting or mitigation should be designed around the protected service and upstream capacity, not one borrowed internet number.
Frequently Asked Questions
Router, firewall, measurement, and baseline questions
What is a good PPS for a router?
A good router PPS capacity is one that keeps your projected peak below a tested feature-on limit at the utilization target you choose. There is no universal home or business PPS number because traffic mix, packet size, routing features, direction, hardware, and test method all change the result.
Is a high packets-per-second value bad?
Not by itself. High PPS may be normal for a busy link or packet-heavy application. It becomes a problem when it approaches a relevant device limit or coincides with packet loss, queue growth, latency, CPU saturation, allowance counters, or a sudden unexplained change from baseline.
How do I measure packets per second?
Use interface packet counters over a measured interval. Linux can report rxpck/s and txpck/s with sar -n DEV 1. Windows Performance Monitor exposes Packets Received/sec and Packets Sent/sec. macOS netstat can show interface statistics at intervals. Routers, switches, cloud NICs, and SNMP monitoring systems expose equivalent counters.
How many PPS is a 1 Gbps connection?
At Ethernet line rate, 1 Gbps spans 81,274 PPS with a 1,500-byte IP MTU and 1,488,095 PPS with minimum-size 64-byte frames. The exact value depends on frame size and the measurement boundary.
How much PPS headroom should I keep?
Choose a planning target from your risk tolerance, growth forecast, traffic variability, and test confidence. Do not use one universal multiplier. A defensible plan projects peak PPS, divides it by the maximum utilization you are willing to accept, and compares that requirement with a feature-on tested capacity.
What does an Mpps rating on a switch or firewall mean?
Mpps means millions of packets or frames per second, but the number is incomplete without test conditions. Check frame size, traffic direction, aggregate versus per-port scope, enabled features, loss criteria, software version, and whether the rating covers forwarding only or stateful inspection.
Does packet size affect a good PPS target?
Yes. Smaller packets produce more PPS at the same bandwidth and usually create more per-packet work. Capacity planning should use the packet-size distribution you expect, plus a small-frame stress case where that failure mode matters.
What PPS counts as a DDoS attack?
There is no universal PPS threshold for a DDoS attack. Treat PPS as one signal alongside source and destination distribution, protocols and flags, packet sizes, connection behavior, drops, latency, and deviation from an established baseline. A legitimate flash crowd can raise PPS, while a harmful attack can overwhelm a small device at a lower rate.
