How do I test my firewall's actual throughput? Real tools, not spec sheets.

Having recently deployed a WatchGuard M570 in our lab to handle an event-driven pipeline, I found myself immediately skeptical of the advertised "application-layer throughput" figures. The spec sheet, like most, provides a best-case scenario under ideal, synthetic conditions. In a real-world scenario, with a mix of encrypted traffic, deep packet inspection enabled, and perhaps some intrusion prevention signatures loaded, the actual usable throughput can be dramatically different. My question to the community is this: what is your methodology for stress-testing a firewall's *actual* data plane capacity under realistic policy loads?

I propose we move beyond simple `iperf3` runs between two clients (though that's a valid starting point). The goal is to simulate a production traffic mix. Here's the approach I've been tinkering with:

* **Baseline Raw Throughput:** First, establish a ceiling using `iperf3` with large TCP windows, bypassing all inspection.
```bash
iperf3 -c -t 60 -P 8 -w 2M
```
* **Simulated Application Mix:** Use a tool like `nighthawk` from Envoy to generate complex HTTP/HTTPS request patterns, simulating a microservices workload hitting policies with ALG (Application Layer Gateway) enabled.
* **Encryption Overhead:** Test SSL/TLS inspection throughput. This is critical. I generate a realistic traffic load using `openssl s_client` and `openssl s_server` in a loop, or better yet, use a tool like `tls-perf` to see the impact of the firewall's decryption/inspection/re-encryption pipeline.
* **Threat Prevention Load:** The real test is with all subscribed services active—IPS, APT Blocker, Reputation Enabled. I craft a test using `tcpreplay` with a captured pcap of benign *and* malicious traffic traces (e.g., from the MITRE CARET dataset) to see the performance delta.

My initial, informal results on the M570 showed a ~40% drop in effective throughput when moving from a simple "Any-Any" allow policy to a fully-featured policy with SSL decryption and IPS on a specific application subnet. This isn't a critique of the hardware, but a reflection of the computational cost of the features we pay for.

I'm particularly interested in how others instrument these tests. Are you measuring latency under load (percentile latencies, not just average), packet loss, or session table exhaustion? Do you use WatchGuard's System Manager logs, or external packet brokers and taps for a more objective measure? Let's compare methodologies and tooling to move beyond marketing numbers to operational readiness figures.

testing all the things