Skip to content

Measurements

Jump to bottom
AbdelmonemAwad edited this page Oct 18, 2026 · 2 revisions

Measurements

The figures that mark where the project is, each with the page that holds it and a photograph of the run - the console window it came from, captured when the run finished. Every page says how the number was taken and what it cannot show; read it before quoting a figure.

The vendor publishes figures of its own for these appliances. They were taken another way, with many connections through the box, and are not comparable to a single stream ending on the appliance's own host.

The bench

Three appliances on one bench, 2026-10-17

A PC with a 10G card, the second XGS 3300 as the router in the middle, the first XGS 3300 behind a 10G fibre and the XGS 136 behind a gigabit link - bench-2026-10-17.md.

The XGS 3300

what figure page
IPv6 connections in the flow table 9.24 Gbit/s one way, 9.27 back, all eighteen directions in hardware ipv6-and-queues-2026-10-18
IPsec, the engines at both ends, MTU 9000 7.41 Gbit/s, one stream mtu-2026-10-17
clear text into its host, MTU 9000 7.11 Gbit/s, one stream mtu-2026-10-17
the flow table 99.6% of frames in hardware xgs3300
over TLS through the flow table 2,391 GiB, not a byte changed xgs3300
one transmit buffer per slot loss under load on another port from 29.2% to 0.0% xgs3300

IPv6 through the XGS 3300: 9.24 Gbit/s and 9.27 back, all eighteen directions in hardware

IPsec into the first XGS 3300 at MTU 9000: 7.41 Gbit/s
IPsec into the first XGS 3300 at MTU 9000: 7.41 Gbit/s 		IPsec in hardware at both ends, MTU 1500: 1.85 Gbit/s
IPsec in hardware at both ends, MTU 1500: 1.85 Gbit/s, as in clear text

The XGS 136

what figure page
receive, one stream 773 Mbit/s in and 934 out - was 18.3 with a ten-millisecond poll a hundred polls a second
MTU 9000 through both switch chips 989 Mbit/s clear, 982 through the IPsec tunnel mtu-2026-10-17
IPsec in hardware at both ends, MTU 1500 902 Mbit/s in, 893 out bench-2026-10-17
four transmit queues all four in use, 941 Mbit/s, the link full ipv6-and-queues-2026-10-18
Before: the ten-millisecond poll
Before: polled every ten milliseconds, 64 frames a pass 		After: every millisecond, 1,024 frames a pass
After: every millisecond, 1,024 frames a pass
IPsec in hardware into the XGS 136: 902 Mbit/s
IPsec in hardware into the XGS 136: 902 Mbit/s 		Four transmit queues, all in use
Four transmit queues: 937, 941 and 941 Mbit/s, eight streams spread over all four

Every run

Home · Photographs · Timeline

Copyright © 2026 Abdelmonem Awad · os-xgs-npu, BSD-2-Clause · OPNsense® is a registered trademark of Deciso B.V.; Sophos® and XGS are trademarks of Sophos Ltd. This project is independent of both.

Home

Before the repository

  1. Two computers in one box
  2. The XGS 136 arrives
  3. Eight months of looking
  4. The first XGS 3300
  5. Reverse engineering
  6. A firmware of its own
  7. The host and the coprocessor

In the repository

  1. Fourteen ports on the XGS 136
  2. The XGS 3300 and the last hop
  3. From ports to offload
  4. An appliance again

Using it

Also

The repositories

Clone this wiki locally