The test results provided in the next two sections illustrate potential impact of enabling response processing traffic.
The things to note about the test are given below.
The test involves only HTTP traffic. Changing the HTTP response processing setting does not change the Sensor performance for any other protocol. Therefore, changes in aggregate Sensor performance will depend on the proportion of HTTP traffic to other traffic on the link being monitored.
The test sends equal HTTP request and response loads in both directions through the Sensor. Typical real-world deployments do not have equal amounts of HTTP request traffic and response traffic in both directions through the Sensor. Usually, there is significant amount of request traffic in one direction and response traffic in the opposite direction. Since HTTP requests are typically <= 1/10th of the response size, the combined HTTP request and response traffic processed by Sensors in real deployments is typically less than that shown in the tests.
The test sends HTTP request continuously at maximum load. Real-world networks are typically loaded, occasionally peaking at maximum capacity, but typically running at significantly lower throughput. The test results reflect performance at sustained load. When not running at maximum load, the Sensor can absorb larger bursts without significant impact.
The test environment was created to illustrate the likely worst-case performance impact, expected to occur in deployments protecting large Web server farms. In these deployments, HTTP response processing typically provides little value because all HTTP response traffic is sourced from trusted servers, which do not usually transmit hostile content due to the security measures taken. In these environments, customers can consider selectively enabling HTTP response processing to better optimize their network.
The net result of all of these factors is that, in typical networks, the impact of enabling HTTP response processing is not noticed. The exact impact is, of course, dependent on the traffic being inspected and some environments could see a reduction in performance as significant as the test results indicate.
The factors to take into account include the following:
Proportion of HTTP traffic to other protocols
Relative amount of HTTP requests and responses in each direction
Size of a response page sent to the client by the sites or applications that are typically accessed
For Sensor performance numbers under the following conditions:
HTTP response processing enabled/disabled
5 HTTP 1.1 get page requests per TCP connection with a 10K response each sent in one direction