The 100 Mbps Link That Behaves Like 20 Mbps
A branch office connects to headquarters over a 100 Mbps MPLS circuit. Users report that bulk file transfers between sites plateau at about 20 Mbps, but latency-sensitive VoIP calls are clean and the carrier's SLA reports show no drops or errors on the circuit. The path has a 60 ms round-trip time. The branch firewall performs stateful inspection and IPS on all traffic, and the branch switch uplink is 1 Gbps. A network engineer runs a single-stream iperf3 test and gets 20 Mbps; a 10-stream test also gets about 20 Mbps total. The WAN router's interface counters show output drops during the transfer bursts. The branch has no local proxy or caching.
1. Before touching the firewall, what should the engineer conclude from the single-stream vs. multi-stream results, and what does that rule out?
Read the worked answer
If a single stream and ten parallel streams both cap at the same aggregate ~20 Mbps, the limit is not per-connection latency (BDP) and not a per-flow CPU/session limit in the firewall. A high-BDP single-stream limit would improve when parallelized; a per-flow inspection limit would also scale up with more flows. The flat aggregate ceiling points to a shared bottleneck: a policer/shaping rate, a link-speed mismatch, or a queue that is dropping. The RTT of 60 ms gives a single-stream BDP of ~0.75 MB, which alone would not cap a modern TCP stack at 20 Mbps, reinforcing that latency is not the cause. The output drops on the WAN router interface are the strongest signal.
2. The firewall is ruled out. Given the output drops, what is the most likely mechanism and how would you confirm it?
Read the worked answer
Most likely a speed/duplex or shaping mismatch: traffic arriving faster than the egress can drain causes output drops on the WAN interface. Confirm by (1) checking the WAN interface negotiated speed/duplex and comparing to the carrier's CIR/contract, (2) looking at the drop counters' rate versus the 20 Mbps plateau, (3) checking whether a shaper or policer is configured at ~20 Mbps, and (4) verifying the branch switch uplink isn't oversubscribed. If the carrier delivers 100 Mbps but a local shaper is set to 20 Mbps, the shaper - not the circuit - is the ceiling. If the interface is half-duplex or mismatched, correcting duplex resolves it. The key is to fix the shared bottleneck, since the flat multi-stream result already excluded per-flow causes.