To test IPS performance, we constructed a test bed that offered traffic at multigigabit rates (see diagram). Two Spirent ThreatEx 2500 appliances offered various exploits, while two Spirent Avalanche 2500 and two Spirent Reflector 2500 appliances offered a combination of benign Web, e-mail, FTP, and DNS traffic.

All IPS systems operated in simple layer-2 bridging mode and thus were transparent to other nodes on the network. The only IP addressing used by the IPS systems was for out-of-band management ports on the sensor and/or on a separate management station.

Return to main IPS test

To force traffic through an IPS, we set up untagged virtual LANs on two switches, and we attached all unprotected-side ports into one switch and all protected-side ports into the other. Because the IPS was the only bridging device on the test bed, it was the only path available between the unprotected and protected sides. Many IPS systems offered multiple pairs of bridge ports; for these, we configured multiple sets of VLANs on either switch.

Our performance tests measured the effects on benign traffic through each IPS while it also dealt with various exploits.

Using Spirent Avalanche traffic generators, we began with a baseline test involving a mix of TCP traffic types (along with a small amount of UDP-based DNS traffic) and measured forwarding rate and HTTP page response time. The TCP tests involved 1,500 concurrent users all asking for a mix of HTTP, FTP, SMTP, POP3 and a small amount of DNS over UDP.