---
title: "W55RP20 TOE vs. LWIP: Network Performance Test with iPerf3"
url: "https://maker.wiznet.io/Hannah/projects/w55rp20-toe-vs-lwip-network-performance-test-with-iperf3/"
markdown_url: "https://maker.wiznet.io/Hannah/projects/w55rp20-toe-vs-lwip-network-performance-test-with-iperf3/md"
type: "WCC: WIZnet Created Content"
author: "Hannah Lee"
editor: "WIZnet"
editor_url: "https://maker.wiznet.io/"
original_author: "Hannah Lee"
published: "2025-03-04"
language: "en"
hardware: ["WIZnet W55RP20-EVB-Pico"]
likes: 0
views: 1468
comments: 0
source: "WIZnet Makers (https://maker.wiznet.io/)"
---

# W55RP20 TOE vs. LWIP: Network Performance Test with iPerf3

> W55RP20 TOE vs. LWIP: Network Performance Test with iPerf3

Original author: Hannah Lee

## Components

- **WIZnet W55RP20-EVB-Pico** x 1 ([docs](https://wiznet.io/products/powered-by-raspberry-pi/w55rp20-evb-pico))

## Article

iPerf3 LwIP code : <https://github.com/WIZnet-ioNIC/WIZnet-PICO-IPERF-C/tree/main/examples/iperf3/lwip>

iPerf3 TOE code : <https://github.com/WIZnet-ioNIC/WIZnet-PICO-IPERF-C/tree/main/examples/iperf3/toe>

### Network Stability Testing with NPING: SYN Flood Attack Simulation

#### Introduction

Network security and stability are critical for any system handling data transmission. One way to assess network robustness is by simulating real-world attack scenarios. This post explores how to use **NPING** to conduct a **SYN Flood Attack** simulation and analyze network stability under stress.

##### NPING Download and Installation

You can download NPING as part of the Nmap suite:

Official website: <https://nmap.org/nping/>

To install on different platforms:

**Linux** (Debian-based)

```plaintext
sudo apt update && sudo apt install nmap
```

**MacOS** (via Homebrew)

```plaintext
brew install nmap
```

**Windows**

Download and install the Nmap package from the official website.

##### SYN Flood Attack Simulation using NPING

A **SYN Flood Attack** is a **Denial of Service (DoS)** attack where an attacker sends multiple TCP SYN packets to a target, exhausting its resources.

**Command to Perform SYN Flood Attack**

```plaintext
sudo nping --tcp -p 80 --flags SYN --rate 1000 -c 10000 <TARGET-IP>
```

![](https://maker.wiznet.io/upload/ckeditor5/15724781%5F1740762254%2Epng)

**Explanation:**

`--tcp` → Use TCP protocol

`-p 80` → Target port 80 (HTTP)

`--flags SYN` → Set SYN flag to simulate a connection request

`--rate 1000` → Send 1000 packets per second

`-c 10000` → Send a total of 10,000 packets

`<TARGET-IP>` → Replace with the actual target IP

##### **Observing Network Stability**

While running the SYN flood, monitor the network behavior using:

**On the Target System:**

```plaintext
netstat -an | grep :80
```

This will show the number of half-open connections.

**Using Wireshark/Tcpdump:**

Capture packets to analyze the impact:

```plaintext
sudo tcpdump -i eth0 port 80
```

![](https://maker.wiznet.io/upload/ckeditor5/15724781%5F1740761911%2Epng)

### **TOE vs. LWIP Performance under SYN Flood Attack**

![](https://maker.wiznet.io/upload/ckeditor5/15724781%5F1740762425%2Epng)

When conducting a SYN flood attack on systems using **TOE (TCP Offload Engine)** and **LWIP (Lightweight IP)**, significant performance differences were observed:

**TOE Performance Drop:** Only **0.3%LWIP Performance Drop:** Around **80%**

##### **Why is TOE More Resilient?Hardware Acceleration:** TOE handles TCP processing at the NIC level, reducing CPU workload.

**Efficient Connection Handling:** Unlike LWIP, which relies on software processing, TOE manages large numbers of connections without excessive resource consumption.

**Offloaded Packet Processing:** SYN flood attacks mainly target the CPU with excessive connection requests. TOE mitigates this by offloading processing tasks to dedicated hardware.

**Reduced Interrupt Overhead:** LWIP needs frequent CPU interrupts to process packets, whereas TOE processes them with minimal CPU intervention.

##### **TOE Advantages in Network SecurityHigher Throughput:** Even under attack conditions, TOE maintains stable performance.

**Lower Latency:** Network applications experience minimal delays.

**Better Resource Utilization:** Frees up CPU cycles for other critical tasks.

**Enhanced DDoS Resistance:** TOE handles malicious traffic more efficiently than software-based stacks like LWIP.

---

Source: https://maker.wiznet.io/Hannah/projects/w55rp20-toe-vs-lwip-network-performance-test-with-iperf3/