The short version
What does iperf3 measure?
iperf3 sends test traffic between a client and a server and reports the throughput achieved across that path. For a Stealth Internet test, run the client on your computer or server at your site and connect to the Stealth test server. Run each direction separately and record the results.
A result reflects the client, its connection, the equipment and network in between, and the server. It does not isolate one component by itself.
01 / Where to connect
Put the client on the customer side.
Connect a capable computer by Ethernet to the network you want to test. The example below includes the office switch and firewall, so those devices are part of the measurement. Your actual topology may differ.
Wired Ethernet
firewall / router
Stealth network
TCP port 5201
Upload / TX: client → server. Download / RX: server → client, using -R. TX and RX are relative to the customer test computer. The command still starts on that computer in both cases.
If an authorized technician connects a test device closer to the handoff, the measured path changes and may exclude your office firewall or switch. Record the exact connection point and any equipment bypassed. Do not disconnect or bypass production equipment without coordination.
02 / Prepare
Make the test meaningful.
- Use a wired adapter, switch ports, cabling, and a test computer capable of the rate being investigated. Verify negotiated link speed; a 1 Gbps link cannot measure a 10 Gbps path at line rate.
- Check that the host has enough CPU and memory and that other applications, VPNs, security tools, and competing traffic are understood. An advertised firewall port speed alone does not establish its throughput with enabled features.
- Schedule a test window: throughput tests can fill a link and disrupt other traffic. At 10 Gbps for 10 seconds, roughly 12.5 GB of payload can be transferred in one direction.
- Use a server you operate or are authorized to test. Check TCP port 5201 is permitted to the server; a busy or unavailable server can limit or prevent a test.
Stealth customers can use iperf3.stealth.net as the example below, subject to availability. If you cannot connect or need help selecting a test window, email support@stealth.net.
03 / Install
Install on the test computer.
Follow your organization’s software approval process. The commands below install the client program; package availability and permissions vary. Run iperf3 --version afterward. Version 3.16 and later use a separate thread per parallel stream, which can matter at high speeds.
Windows: Ubuntu through WSL
One option is Windows Subsystem for Linux (WSL). In an Administrator PowerShell window on a supported Windows system, run the command below, restart if prompted, and complete Ubuntu’s first-run account setup. Your organization may restrict virtualization or installation.
wsl --installOpen Ubuntu from the Start menu and run:
sudo apt update
sudo apt install iperf3
iperf3 --versionRun the test commands in that Ubuntu window. WSL adds a virtualized networking layer and may influence high-speed results; record that WSL was used. ESnet does not officially support native Windows iperf3; third-party Windows builds are available, but check their provenance and your organization’s policy. iperf2 and iperf3 are different, incompatible test tools.
macOS
In Terminal, with Homebrew already installed and approved:
brew install iperf3
iperf3 --versionLinux
On Ubuntu or Debian, use:
sudo apt update
sudo apt install iperf3
iperf3 --versionOn Fedora or a compatible distribution, use sudo dnf install iperf3. If the package manager offers to configure a background server, a client-only test does not require starting a server on your computer.
04 / Test each direction
Run from the customer computer.
These examples use TCP, a 10-second test, and Stealth’s test server. Start with a single stream in each direction, then compare eight streams. Allow each test to finish before starting the next.
Upload: customer client sends
iperf3 -c iperf3.stealth.net -P 1 -t 10
iperf3 -c iperf3.stealth.net -P 8 -t 10Download: customer client receives
iperf3 -c iperf3.stealth.net -P 1 -t 10 -R
iperf3 -c iperf3.stealth.net -P 8 -t 10 -R-c selects client mode and the server; -P sets parallel streams; -t sets duration in seconds; -R reverses the data direction. Eight-stream throughput is an aggregate, not the speed of a single connection. Repeat comparable tests at an agreed time; a single result is a starting point.
For a two-site test using your own authorized server, start iperf3 -s on that other machine, then replace the hostname in the client commands with its reachable address. The default server port is TCP 5201. Restrict access and stop the server when finished. Testing two devices on the same LAN does not test the Internet circuit.
05 / Read the result
Follow the numbers.
The following is actual iperf3 output from a short same-machine loopback demonstration, captured November 3, 2026 using iperf3 3.20+. The client and server both use 127.0.0.1; this traffic did not cross a physical interface, Stealth’s network, or an Internet circuit.
$ iperf3 -c 127.0.0.1 -p 53291 -t 2 -P 2
Connecting to host 127.0.0.1, port 53291
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 5] 0.00-1.00 sec 4.04 GBytes 34.7 Gbits/sec 0 4.25 MBytes
[ 7] 0.00-1.00 sec 4.01 GBytes 34.3 Gbits/sec 0 1.25 MBytes
[SUM] 0.00-1.00 sec 8.05 GBytes 69.1 Gbits/sec 0
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-2.00 sec 8.27 GBytes 35.5 Gbits/sec 0 sender
[ 5] 0.00-2.00 sec 8.27 GBytes 35.5 Gbits/sec receiver
[ 7] 0.00-2.00 sec 7.74 GBytes 33.2 Gbits/sec 0 sender
[ 7] 0.00-2.00 sec 7.74 GBytes 33.2 Gbits/sec receiver
[SUM] 0.00-2.00 sec 16.0 GBytes 68.7 Gbits/sec 0 sender
[SUM] 0.00-2.00 sec 16.0 GBytes 68.7 Gbits/sec receiver
iperf Done.| Field | Meaning |
|---|---|
| ID / SUM | Each numbered row is a stream; SUM combines the streams. Compare the final receiver SUM for aggregate delivered throughput. |
| Interval | Time covered by a row. Per-second rows show variation; final rows summarize the test. Actual duration can differ slightly from the requested duration. |
| Transfer / Bitrate | Data transferred and average rate during the interval. Bytes and bits differ: 1 byte is 8 bits. The result is throughput between endpoints, not an automatic circuit certification. |
| Retr / Cwnd | TCP retransmissions and the sender’s congestion window, where the platform reports them. Retransmissions can have several causes; a count alone does not locate a fault. These fields may be absent on some platforms. |
| Sender / receiver | End-of-test summaries for each side. Small differences can reflect timing or data in flight; do not interpret their difference alone as packet loss. With -R the server is the sender. |
Output depends on version, operating system, direction, and protocol. UDP has different fields, including datagram loss and jitter; do not interpret those as TCP retransmissions.
06 / Investigate
What if the result is lower than expected?
Check the negotiated Ethernet speeds and the connection point first. Compare a single stream with eight and compare upload with download. A higher multi-stream result can reveal a per-flow or host limitation, but does not identify the cause. Inspect host CPU and interface errors, firewall features and load, concurrent traffic, server availability, and the path. A speed test to another server uses a different endpoint and may produce different results.
If permitted, repeat from a second capable wired computer or at another approved point in the path, changing one thing at a time. Save the before-and-after results and timestamps. Avoid changing system-wide TCP settings or disabling security controls based on one test. A dedicated test instrument may be appropriate for a controlled high-speed service test.
For a closer look at the test host, see our high-speed network tuning guides for Linux, FreeBSD, macOS, and Windows. ESnet’s host tuning references cover operating systems and high-speed network paths. Measure first and check recommendations against your OS version and environment before changing settings.
Connection refused, timeout, or server busy? Check the server name, port and local policy, and whether a VPN changes the path. The server may be unavailable or already running a test. Ask support rather than treating this alone as evidence of a circuit fault.
07 / Stealth support
Send the results for analysis.
Email support@stealth.net with the complete output of each test, including command, interval rows and final sender and receiver summaries. Paste text when possible, or attach readable screenshots. Please include:
- Date, time and time zone; service location; and whether other traffic was active.
- A simple path diagram or description showing the client, switch, firewall/router, handoff, and any VPN or bypass.
- Test computer operating system, iperf3 version, adapter and negotiated link speed; identify WSL or another virtual environment if used.
- Firewall/router make, model, software version, and relevant enabled features; the server and test direction.
- What result you expected, what you observed, and any other test results taken under comparable conditions.
Review output before sharing it: addresses and hostnames may be sensitive. Coordinate with support about any details your organization cannot send by email.
About this guide
Sources and further reading.
iperf3 documentation
- ESnet: invoking iperf3Commands, options and output
- ESnet: obtaining iperf3Platform packages and support
- ESnet: frequently asked questionsPlatform and measurement limitations
Operating systems
- Microsoft: install WSLRequirements and Windows setup
- Homebrew: iperf3macOS package
Prepared by Stealth Communications. Test methods and results depend on the equipment, configuration, endpoint and path.