Fastly Next-Gen WAF Agent Performance Benchmarks

The Fastly Next-Gen WAF engineering team developed an agent performance testing framework to determine CPU and memory utilization in various host configurations. The resulting benchmarks represent what our customers routinely see in their production deployments: that our lightweight agent requires few host resources, will not create significant latency yet remains performant.

Introduction

From inception, the Fastly Next-Gen WAF agent was designed to be as lightweight and efficient as possible wherever our customers run their apps and APIs. We provide the agent performance metrics in this document based on internal performance testing to prove out that our agent is lightweight, requires few host resources, and will not create significant latency once installed1. When evaluating web application and API protection solutions, we know performance is top of mind for development and operations teams: businesscritical applications must be performant and available to drive your business. Additionally, legacy WAF and other application and API protection solutions typically lead to significant performance and reliability issues that do not occur with the Next-Gen WAF.

Example Performance Benchmark Scenario

To report on the benchmarks presented in this document, our engineering team analyzed our agent usage metrics across multiple typical customer configurations. Below we focus on one test scenario our team chose because it reflects a common host configuration we see across our customer base. Most acronyms used in this document will be known to development, operations, and security professionals, but to be clear, “RPS” stands for “Requests Per Second”: 1,000 web requests per second per server is well over the average request volume of even large scale web apps and APIs experience in production. As the data below proves, even with significant request traffic load, our agent decision remains fast and performant, which is why it’s trusted by some of the largest scale companies on the Internet. Before moving on to the benchmark results, two factors influence the resulting agent performance metrics in our test scenario:

• Request rate (RPS) and size impact performance results most.

• The larger the request volume, the bigger the request size, and thus, the more CPU and memory resources are required.

Typical Test Scenario

1,000 RPS on compute instance with eight (8) cores running at 3.6GHz: running the benchmark test on a host with this configuration, the following findings result:

• Median agent decision time required: under one millisecond. Larger requests take longer, but the agent still decides to block or allow the request in an average of 1.43ms for requests over 7KB in size.

• CPU utilization on average: up to 35% for medium-sized requests.¹

• Agent memory utilization: around 40MB of available host memory¹ — memory utilization is dependent on volume and size.

NOTE: The resulting metrics do not include overhead potentially generated by the module. The Next-Gen WAF's module resource consumption is highly dependent on the application itself. However, typical applications add very little overhead.

¹ Performance can vary by environment so you may not see similar results.