DDoS Packet-Per-Second (Mpps), Gbps Bandwidth & WAF Rate-Limit Calculator (2026)

Although a minimum Ethernet frame is 64 bytes (512 bits), IEEE 802.3 requires a 7-byte preamble, a 1-byte Start Frame Delimiter (SFD), and a 12-byte minimum Inter-Frame Gap (IFG) between every packet on the wire. That adds 20 bytes (160 bits) of Layer-1 overhead per packet, totaling 84 bytes (672 bits). Dividing 10,000,000,000 bps by 672 bits/packet yields exactly 14,880,952 packets per second (14.88 Mpps).

Routers, load balancers, and stateful firewalls must inspect headers, perform routing lookups, and allocate conntrack state-table entries for every individual packet. A 2 Mpps flood of 64-byte SYN packets consumes only ~1.34 Gbps of wire bandwidth, but easily exhausts CPU interrupts and state tables on hardware rated for high throughput with 1500-byte packets.

In a reflection/amplification attack, the attacker sends small UDP requests with a spoofed source IP (set to the victim's IP address) to open third-party UDP servers (such as DNS resolvers, NTP servers, or misconfigured Memcached instances). Because UDP has no three-way handshake to verify the source IP, those servers send massive multi-kilobyte responses directly to the victim, multiplying the attacker's bandwidth by 50x to 51,000x.

L3/L4 attacks (ICMP floods, UDP amplification, TCP SYN floods) target network pipes and TCP/IP stack state tables measured in Gbps and Mpps. L7 attacks complete a valid TCP/TLS handshake and send legitimate-looking HTTP/HTTPS requests (measured in Requests Per Second, RPS) targeting expensive backend database queries, search endpoints, or login APIs.

BCP38 is Network Ingress Filtering implemented by ISPs at the network edge. It drops any outbound packet whose source IP address does not belong to the customer's assigned prefix, preventing botnet nodes from spoofing a victim's IP address to trigger UDP reflection.