Bps vs pps vs rps: the three numbers that size a DDoS

02How many packets per second fit in a gigabit?

The answer depends entirely on packet size, because Ethernet adds a fixed overhead to every frame. On the wire each frame carries a 7-byte preamble, a 1-byte start-of-frame delimiter and a 12-byte inter-frame gap, which is 20 bytes of overhead that never changes. The smallest valid Ethernet frame is 64 bytes, so the smallest thing on the wire is 64 + 20 = 84 bytes, or 672 bits.

Divide the link speed by that and you get the maximum packet rate. At 1 Gbit/s that is 1,000,000,000 / 672 = 1,488,095 packets per second, the well-known 1.488 Mpps per gigabit figure. A 10 Gbit/s link therefore tops out near 14.88 Mpps of minimum-size frames. Cisco's own performance note gives the same range: a 1-Gb/s link carries between 81,274 and 1,488,096 packets per second depending on size.

Large packets flip the ratio. A 1500-byte payload becomes a 1,518-byte frame, or 1,538 bytes on the wire, so a 10 Gbit/s link carries only about 812,744 of those per second. The same bandwidth, roughly eighteen times fewer packets. This is the heart of why packet rate and bandwidth are different problems.

on-wire bytes   = frame bytes + 20
packets/second  = link bits per second / (on-wire bytes * 8)

64-byte frame :  1 Gbit/s  / (84   * 8) = 1,488,095  pps  (1.49 Mpps)
64-byte frame : 10 Gbit/s  / (84   * 8) = 14,880,952 pps  (14.88 Mpps)
1500 payload  : 10 Gbit/s  / (1538 * 8) =    812,744 pps  (0.81 Mpps, 1518-byte frame)

03Why can a small Gbps flood kill a server a bigger one survives?

Because the device limit is usually packets, not bits. Routers, switches and network cards are rated for a forwarding rate in packets per second; a stateful firewall is rated for new connections per second and concurrent connections. None of those limits care how big each packet is. A flood of tiny packets hits the packet limit long before it hits the bandwidth limit.

Take a hypothetical small virtual server or edge router that can forward roughly 1 Mpps. A 5 Gbit/s flood of full-size 1500-byte packets is only about 0.41 Mpps, well within reach, so the box keeps working. A 1 Gbit/s flood of 64-byte packets is 1.49 Mpps, which overruns the same box even though it is one fifth of the bandwidth. The smaller attack in bits is the larger attack in packets, and packets are what breaks.

This is exactly why packet-rate attacks have grown. In April 2024 OVHcloud reported an attack of roughly 840 Mpps, then a record, 99% of it TCP ACK packets from about 5,000 source addresses. The point of such an attack is not to fill a 100-gigabit pipe; it is to exceed the per-second packet budget of the gear in the path.

04Which attacks stress which metric?

Roughly, the three classic layers of DDoS map onto the three metrics. Volumetric attacks aim at bandwidth (bps). Protocol and state attacks aim at packet rate and connection tables (pps). Application-layer attacks aim at request handling (rps). Many real campaigns combine them, which is why a single figure is never the whole story.

• A volumetric flood is sized in bps because the goal is to overrun the pipe; see amplification attacks for how a small request becomes huge traffic
• A protocol flood is sized in pps because each small packet costs the same to process; this is the realm of Layer 3/4 attacks
• An application flood is sized in rps because each request triggers real work behind it, as in an HTTP flood

05What do the record numbers actually mean?

Record attacks are reported in whichever metric they set, which is why the headline numbers look unrelated. Cloudflare's report for the third quarter of 2025 (December 2025) described a 29.7 Tbps attack and a separate 14.1 billion packets per second attack, both from the Aisuru botnet. Its report for the fourth quarter (February 2026) described a 31.4 Tbps attack that lasted 35 seconds. The bandwidth record and the packet-rate record were different attacks.

Application-layer records are separate. The HTTP/2 Rapid Reset campaign of 2023 produced attacks of more than 201 million requests per second (Cloudflare) and 398 million (Google), using a technique that cost the attacker almost nothing per request. Cloudflare's fourth-quarter 2025 report put the largest HTTP floods of that campaign at 205 million requests per second, the highest rates it had seen since Rapid Reset. No amount of bandwidth planning helps against a request-rate flood, and no request limit helps against a packet-rate flood.

The practical lesson is to read all three numbers whenever an attack or a protection product is described. A table that lists only Tbps hides whether the real pressure was on the pipe, the processor or the application.

06How do I convert between Gbps and Mpps for my own numbers?

Use the formula above, or the bandwidth and packets-per-second calculator, which does the arithmetic for any frame size and includes the 20-byte Ethernet overhead. Enter your link speed and a frame size to see the packet rate, or enter a packet rate to see the bandwidth it occupies. It runs in the browser.

When you plan capacity, convert the attack you fear into the metric your weakest component limits. If your router is the constraint, work in pps. If your transit is the constraint, work in bps. If your application is the constraint, work in rps. Then compare each against the relevant rating, not against a single Gbps headline. For the wider picture of how these attacks are absorbed off your network entirely, see what DDoS mitigation is and how to stop a DDoS attack.