How Ideco Measures NGFW Performance Using TRex ASTF and RFC 9411 Methodology
Ideco has shared a comprehensive look at how its engineering team measures the performance of Ideco NGFW Novum on the Ideco EX platform. The article explains why raw performance numbers are meaningless without a clearly documented methodology and describes every parameter used in their lab tests.
Why Performance Numbers Vary Across Tests
The same NGFW device can produce very different results on two different test beds even when both tests are honest. Performance depends on packet size, enabled security functions, number of rules, test duration, and the acceptable loss threshold. Ideco therefore publishes its full methodology so that any reader can reproduce the measurements and understand exactly what each figure represents.
Traffic Generator and Test Modes
The team selected the open-source TRex generator running in ASTF (Advanced Stateful) mode. This choice enables realistic TCP session handling and L7 emulation, which is essential for testing stateful inspection engines. Stateless mode is used only for raw UDP throughput tests with 1518-byte frames. When TLS decryption is enabled on the firewall, the team switches to the hardware-based Keysight BreakingPoint system.
Test Bed Configuration
Both the device under test and the traffic generator use identical server hardware:
- CPU: Xeon Gold 6338N
- RAM: 128 GB
- NICs: Intel E810 2xQSFP28 (100 Gbps)
The topology is a simple two-port setup with TRex port 0 connected to the DUT and TRex port 1 returning the traffic.
Key Metrics and Traffic Profiles
The methodology measures four primary metrics: throughput in Gbit/s, connections per second (CPS), concurrent connections (CC), and latency. Tests are performed with the following profiles:
- UDP 1518-byte frames (raw L2/L3 ceiling)
- TCP/HTTP with 64 KB objects
- TCP/HTTP with 16 KB objects
- EMIX mixed corporate traffic
- TCP CPS and TCP CC specific tests
All tests run with a fixed set of firewall rules, IPS signatures, and application control profiles. TLS decryption remains disabled during these runs.
Loss Criterion and Test Duration
Loss is defined as dropped sessions rather than individual packets. The formula uses TRex counters for TCP connection drops, established session drops, and UDP keepalive drops. A test point passes only when session loss stays at or below 1 %. Each load point is held for 300 seconds after a 30-second ramp-up phase to reveal queue buildup, memory pressure, and thermal effects that short bursts would miss.
Results Summary
On the Ideco EX platform the measured maximums are:
- UDP 1518 B: 200 Gbit/s
- TCP/HTTP 64 KB: 100 Gbit/s
- TCP/HTTP 16 KB: 62 Gbit/s
- EMIX (firewall only): 92 Gbit/s
- EMIX + IPS: 31 Gbit/s
- Full NGFW stack: 15.5 Gbit/s
- TCP CPS: 800 000 new sessions per second
- TCP CC: 21 000 000 concurrent sessions
The article concludes that performance is always a range that depends on the actual traffic mix and enabled security functions. Full configuration files and commands are provided so the community can replicate the tests.
Related articles
Why 99% Attack Detection Rules Generate 99.9% False Positives in Real SOC Environments
A detection rule claiming 99% attack coverage with only 1% false positive rate sounds effective on paper, yet in practice it produces roughly one thousand false alerts for every genuine incident. Using a realistic example of 200,000 daily logins containing just two real compromises, the article demonstrates that 1.98 true positives are buried among 2,000 false positives. Bayes' theorem explains why sensitivity improvements barely move the needle while reducing the false-positive rate or narrowing the population yields dramatic gains in precision. The piece outlines three practical levers—lowering FPR, scoping rules to high-risk accounts, and cascading cheap-then-expensive checks—that cut analyst workload by orders of magnitude without sacrificing meaningful coverage. It also warns that chronically low-precision rules train analysts to ignore alerts, eventually leading to the rule being disabled despite remaining in compliance matrices. The recommended metric pair is therefore confirmed detections alongside coverage, rather than coverage alone.
ChatGPT Knows Your Company but Google Doesn't: Step-by-Step Guide to Diagnosing AI Visibility Issues
The complaint that a brand is missing from AI answers often masks six distinct technical problems that require opposite fixes. The guide separates three visibility layers—model knowledge without search, pre-indexed search bots such as OAI-SearchBot, and on-demand agent bots such as ChatGPT-User—and explains how to measure each one. It details checks for robots.txt entries, nosnippet and max-snippet meta tags, Cloudflare AI bot toggles, and server logs that reveal 403, 429, and 404 responses from specific crawlers. Additional steps cover JavaScript-rendered content, repeated query testing across 20 prompts, official reports in Yandex Webmaster and Google Search Console, and hidden prompt-injection instructions that may have been planted in page metadata. The article stresses that aggregated “AI visibility” percentages are meaningless without layer separation and warns that blocking training can unintentionally harm ordinary search indexing.
redb.Identity Adds gRPC Transport for OpenID Server Alongside Existing HTTP Facade
redb.Identity has introduced a second transport layer using gRPC next to its existing HTTP interface, sharing the same core routes, client registry, token store, and authorization logic. The new facade exposes standard OAuth and OpenID Connect operations such as Token, Introspect, Revoke, UserInfo, Discovery, and Jwks through protobuf-defined methods under identity.v1.Identity. Both transports enforce identical verdicts based on a single centralized scope table located behind direct-vm addresses, ensuring that a client authorized via HTTP receives the same result when calling gRPC. Error handling on gRPC uses status codes and trailers to carry machine-readable OAuth error codes and retry-after values, preserving compatibility with existing interceptors and tracing. Browser-facing flows, DPoP proofs, and user self-service remain on HTTP, while administrative operations are available on a separate management port. The implementation was validated through 64 unit tests, cross-language interop with @grpc/grpc-js clients, and a conformance run against the official OpenID Foundation suite.
Nvidia to Cease Regular GeForce Driver Updates for Windows 10 After October 2026
Nvidia has announced the end of regular driver support for Windows 10 in its GeForce Game Ready and Nvidia Studio driver lines starting October 2026. The first driver package without Windows 10 support will arrive in November of that year. Microsoft ended the base lifecycle of Windows 10 on October 14, 2025, and Nvidia is extending support by one additional year. Existing games and applications will continue to function after the change, while quarterly security patches for critical vulnerabilities will remain available until October 2029. Users will no longer receive optimizations for new games, fixes for graphics issues, or new GPU features. Newer technologies such as DLSS may also skip Windows 10 compatibility. The transition is described as gradual rather than abrupt, allowing older titles to keep running while newer releases increasingly encourage migration to a supported Windows version.