My colleague Imran Yousaf and I recently had the opportunity to evaluate a Cisco IronPort Email Security Appliance (ESA) Model C390.
Our primary objective was to benchmark its maximum outbound throughput—specifically, how many outbound emails this appliance could process in a single hour. Determining the performance of this single hardware unit is critical for sizing and structuring a multi-node cluster that can handle our daily email volume.
The Benchmarking Challenge
Email delivery relies on a wide variety of distinct components working together in real time:
- Antivirus scans and reputation analysis.
- Antispam filters and attachment sandboxing.
- Available network bandwidth and latency.
- Sender/recipient domain reputations.
- Recipient-side rate limiting and throttling (greylisting).
Because of these variables, end-to-end delivery times can fluctuate significantly even for identical test batches.
To establish a reliable baseline, we set up our own dedicated testbed. We generated bulk outbound SMTP traffic from a Linux machine using smtp-source, a multi-threaded SMTP/LMTP test generator. During each run, we monitored queue depths, CPU utilization, and execution times.
Testing Command Syntax
time smtp-source -s <connections> -l <bytes> -m <mails> -c -S "<subject>" -f <sender> -t <recipient> <gateway_ip>:25-s: Concurrency / active SMTP connections.-l: Message length in bytes.-m: Number of messages to send.-c: Display progress.-S: Custom subject line.
Benchmarking Test Results
We executed 13 different test runs across various scopes.
Test Bed Conditions:
- Runs 1–8, 12, & 13 (Local dropping): The ESA accepted all incoming emails and processed them through the filters but was programmed to drop the messages at the end of the queue instead of forwarding them to an external mail server.
- Runs 9 & 10 (External Gmail): Emails were generated from three different sources simultaneously and forwarded to three separate, real external Gmail accounts.
- Run 11 (Internal SMTP): Emails were processed and delivered to an internal SMTP server on our local network.
Here is the complete aggregated data from all 13 benchmarking test runs:
| Run | Connections | Mail Count | Mail Size | Target / Condition | Elapsed Time (Real) |
|---|---|---|---|---|---|
| 1 | 1 | 500 | 5 KB | Local Dropping | 0m7.223s |
| 2 | 1 | 5,000 | 5 KB | Local Dropping | 1m14.261s |
| 3 | 1 | 5,000 | 50 KB | Local Dropping | 2m18.681s |
| 4 | 1 | 10,000 | 15 KB | Local Dropping | 2m52.353s |
| 5 | 1 | 20,000 | 15 KB | Local Dropping | 5m47.147s |
| 6 | 10 | 2,000 | 15 KB | Local Dropping | 0m23.046s |
| 7 | 10 | 20,000 | 15 KB | Local Dropping | 3m46.463s |
| 8 | 10 | 60,000 | 50 KB | Local Dropping | 14m19.163s |
| 9 | 3 (1/src) | 3,000 (1k/src) | 5 KB | Real External Gmail | ~9m22s (parallel) |
| 10 | 30 (10/src) | 30,000 (10k/src) | 5 KB | Real External Gmail | ~10m23s (parallel) |
| 11 | 10 | 100,000 | 5 KB | Internal SMTP Server | 21m50.590s |
| 12 | 1 | 20,000 | 500 KB | Local Dropping (Heavy payload) | 11m46.102s |
| 13 | 1 | 100,000 | 500 KB | Local Dropping (Heavy payload) | 58m52.986s |
Key Observations
1. The Impact of Concurrency
Comparing Run 5 (1 connection, 20k mails: 5m47s) with Run 7 (10 connections, 20k mails: 3m46s) illustrates how concurrency optimizes the ESA’s internal processing queues, reducing processing times for the same payload volume by over 35%.
2. Payload Size Scaling
Comparing Run 2 (5k mails at 5 KB: 1m14s) with Run 3 (5k mails at 50 KB: 2m18s) shows that a 10x increase in mail size only doubled the overall processing time, proving that the appliance's queue-writing mechanisms are highly optimized for larger file payloads.
3. Real-World External Delivery Bottlenecks
In Run 10, when delivering 30k emails externally to Gmail from parallel sources, the average time rose to 10 minutes and 23 seconds. This is due to Google's external throttling, greylisting, and network propagation delays, showing that outbound performance is heavily bounded by recipient-side capabilities.
Conclusion & Sizing SMR
Based on the data gathered across these 13 tests, we concluded that the Cisco IronPort C390 ESA can process and deliver 50 to 60 emails per second (equivalent to approximately 180,000 to 216,000 emails per hour) in a standard enterprise delivery environment.
Benchmarking Context
These results reflect our specific test environment, network parameters, and scanning configuration. For a precise cluster sizing blueprint tailored to your enterprise, please consult with your Cisco Account Manager.
