Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is the typical latency added when using a Cisco firewall such as ASA 5505? Are we talking less than 50 microseconds?

share|improve this question
are you talking about microseconds or milliseconds? – Dan May 15 '12 at 14:45
Hmmm... could have sworn that question said "milliseconds" when I first read it. – Ladadadada May 15 '12 at 14:53
Its pretty clear...microseconds. – DD. May 15 '12 at 19:17
up vote 5 down vote accepted

The high-end Cisco ASA 5580 series has a published spec of 30μs latency as a selling point for ultra low-latency environments. The entry-level ASA 5505 would not be close to that level. I'd assume that 50μs is out of reach for the 5505.

share|improve this answer
Interesting...any idea where I can find out? – DD. May 15 '12 at 19:16

I'm seeing about 3ms - 4ms between my web servers and my database servers for the TCP connection ( SYN -> SYN/ACK -> ACK ) traveling through an ASA 5510.

So yes, less than 50ms.

I don't know if the ASA 5505 is comparable.

For comparison, three TCP connections between two hosts on the same network that didn't travel through the ASA 5510 took 256μs when averaged. (Same methodology as the first measurement.)

share|improve this answer
Are you measuring in milliseconds or microseconds? – ewwhite May 15 '12 at 14:43
@Ladadadada: Any chance you could show us your methodology for measuring this? I think that will be more useful in the long run to the world at whole than just the one sample.. – Kyle Brandt May 15 '12 at 14:44
ms is not microseconds - you're measuring milliseconds there. 1ms (millisecond) is equal to 1000 µs (microseconds). – Dan May 15 '12 at 14:45
I have an ASA 5505 and I see about 5 - 8 ms in the same metric @Ladadadada is describing. – tacos_tacos_tacos May 15 '12 at 14:47
ms is milliseconds. μs is microseconds. I'm talking about milliseconds here. My methodology was to fire up tcpdump and subtract the timestamp of the first packet after the three-way handshake from the timestamp of the first SYN. I did this for three connections and averaged them. (Hardly statistically significant, I know, but they were all very close to the same value.) – Ladadadada May 15 '12 at 14:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.