WAF rule sets, not engines, are the real performance limiter

TL;DR: Tetrate benchmarks three Envoy WAF builds and finds that the engine overhead is small, while rule-set scope drives most of the latency, CPU, and memory cost, with full OWASP CRS body inspection materially changing capacity planning. That shifts the governance question from platform selection to policy scope, route targeting, and workload-specific inspection depth.

Editorial analysis by NHI Mgmt Group, based on content published by Tetrate: “Get a High-Performance WAF With Better Rules: Benchmarks on Rules vs. Engine”.

By the numbers:

• Full OWASP CRS on 1 KB bodies sustained about 1,000 RPS per 6-core instance with a 4.86 ms p99 on TEG WAF.
• Full CRS on larger bodies drove CPU cost to about 18.15 cores per 1,000 RPS at 50 KB.
• Peak memory stayed under 80 MB with targeted rules but rose to 100-205 MB under full CRS.

Key questions

Q: How should teams size a WAF when rule sets vary by route?

A: Size it by the heaviest policy that a route will actually carry, then validate the p99 latency and CPU headroom at that depth.

Q: Why does full OWASP CRS cost so much more than targeted WAF rules?

A: Full CRS evaluates hundreds of checks against every request, including body parsing and rule-phase execution.

Q: What are the signs that a WAF policy is too broad for production?

A: Watch for rising p99 latency, CPU saturation, and memory growth when request bodies are enabled or when broad rule groups are added.

Practitioner guidance

• Measure WAF cost by rule tier, not by brand Benchmark header-only, targeted, and full-CRS policies separately so capacity planning reflects the actual inspection depth you intend to run.
• Scope body inspection to the routes that need it Apply request-body parsing and deep inspection only to endpoints that carry meaningful attack exposure, such as login, upload, and API submission paths.
• Set latency budgets before enabling broad CRS coverage Define acceptable p99 latency and CPU ceilings for each application class before enabling full OWASP CRS across production traffic.

Bottom line: The article shows that WAF performance is constrained more by rule-set scope than by the underlying engine choice.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →