Bandwidth is the maximum, theoretical rate at which a given link can transfer data over a period of time. It is expressed in bits per second (bps) and its multiples: Kbps, Mbps, Gbps. Bandwidth tells you the capacity of a channel — how much data fits in it — not how much you actually manage to send. That second figure is called throughput.
Watch out for one trap: the word “bandwidth” has two meanings. In computer networking it means a data rate (bits per second). In signal processing it means something else — a frequency range measured in hertz (Hz), the gap between the highest and lowest frequency of a channel. This entry covers the networking meaning.
How is bandwidth measured?
Bandwidth is stated as the number of bits sent per second. Units are easy to mix up here. Bits (lowercase b, e.g. Mbps) describe link capacity. Bytes (uppercase B, e.g. MB/s) describe file size. One byte is eight bits, so a 100 Mbps link tops out at roughly 12.5 MB/s — which is why a download in your file manager looks eight times slower than the speed on your contract.
You can think about the same bandwidth in a few ways:
- Nominal capacity — the maximum set by the link technology, e.g. 1 Gbps on an Ethernet port.
- Available bandwidth — the part of that capacity not taken up by current traffic at a given moment.
- Consumed bandwidth — what is actually in use, i.e. real throughput or goodput.
How does bandwidth differ from throughput?
Put simply: bandwidth is a theoretical value, the upper ceiling of a link. Throughput is a measured value — how much data was really and correctly sent in a given time. Throughput is usually lower than bandwidth, because a few things get in the way:
- congestion and packet queuing on the devices along the path,
- lost packets and the retransmissions that follow, especially under TCP,
- latency and its variation (jitter),
- protocol overhead — TCP/IP headers, connection setup, flow control,
- the limits of the hardware and the performance of the end devices.
Example: a link with 1 Gbps of bandwidth may at a given moment deliver throughput of around 500 Mbps if the network is congested or dropping packets. There is an even narrower measure — goodput — which counts only the payload data, leaving out headers and retransmissions.
Bandwidth, throughput and “speed”
People often use “bandwidth” and “speed” as if they were the same, but they are not. Speed is the rate at which data moves; bandwidth is the capacity that makes that rate possible. Think of a pipe: bandwidth is how wide the pipe is, while throughput is how much water actually flows through it right now.
How does latency affect bandwidth?
Bandwidth and latency are two separate properties of a link. Bandwidth tells you how much data fits in the channel. Latency tells you how long a single packet takes to reach its destination (measured for example by RTT, the round-trip time). A link can have high bandwidth and high latency at the same time — satellite links are a classic case.
For window-based protocols such as TCP, the key figure is the bandwidth-delay product (BDP) — bandwidth multiplied by round-trip time. It tells you how much data can be “in flight” at once. If the TCP window is too small relative to the BDP, some of the available bandwidth goes to waste on high-latency links (so-called long fat networks).
How do you plan and manage bandwidth?
Capacity planning comes down to adding up what each application needs and multiplying by the number of concurrent users, with some headroom for traffic peaks. Common ways to manage bandwidth include:
- QoS (Quality of Service) — giving priority to latency-sensitive traffic such as VoIP calls and video over bulk traffic.
- Traffic shaping and policing — smoothing or capping flows to set limits.
- Throttling — administratively limiting bandwidth for selected services or users.
- Load balancing and link aggregation (LAG/LACP) — spreading traffic across several connections at once.
- Bandwidth on demand and SD-WAN — scaling capacity elastically and steering paths in real time.
Why does bandwidth matter for security?
Watching bandwidth usage is one of the basic signals in threat detection. It draws on flow data (NetFlow, IPFIX, sFlow) and traffic analysis (NDR/NTA). Unusual spikes in volume often signal an incident:
- DDoS and volumetric attacks — saturating a link’s bandwidth to take a service down; they show up as a sudden jump in
bpsorppsagainst the normal baseline. - Data exfiltration — unusually large outbound traffic, especially outside business hours or to unknown destinations.
- Tunneling and C2 — covert channels (e.g. DNS tunneling, encrypted traffic) that produce distinctive volume and frequency patterns.
- Cryptominers and botnets — steady, suspicious background traffic that loads the link.
That is why the starting point is a baseline — a picture of normal bandwidth usage per host, service and traffic direction. Bandwidth itself is not a security metric, but measuring it continuously (per interface, application, user) gives the context needed to correlate events in a SOC.
Learn more
- What is NetFlow and how is this protocol used in practise? — NetFlow exports flow records that summarize bandwidth use by source, destination, and protocol.
- Secure Access Service Edge (SASE) — SASE relies on bandwidth-aware routing and traffic control to maintain user access quality.
- Network monitoring and network visibility – traffic analysis as the foundation of cybersecurity visibility — Traffic analysis shows how bandwidth is consumed across the network.
