iPerf3 Network Throughput Server on AWS User Guide

Overview

iPerf3 is the de-facto open source tool for actively measuring the maximum achievable bandwidth on IP networks. This cloudimg image runs iPerf3 as a hardened systemd service listening on TCP and UDP port 5201, so you can spin up a throughput server in any AWS region and measure real TCP and UDP performance, jitter and packet loss from your clients, data centres or other clouds. The server runs under a dedicated unprivileged user and generates a per-instance details file on first boot. Backed by 24/7 cloudimg support.

What is included:

• iPerf3 running as iperf3.service (a hardened systemd unit) on TCP and UDP port 5201
• A dedicated unprivileged iperf3 system user (the server never runs as root)
• A per-instance /root/iperf3-server-info.txt written on first boot with the server IP, port and ready-to-paste client commands
• 24/7 cloudimg support

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched:

Prerequisites

An active AWS account, an EC2 key pair in your target region, and a VPC with a subnet that assigns a public IP (or a bastion/VPN path to the instance). The recommended instance type is m5.large; choose a size with higher network bandwidth if you want to measure multi-gigabit throughput. Your instance security group should allow inbound 22/tcp from your management network and 5201 for both TCP and UDP from the networks you will test from.

Step 1 - Launch from AWS Marketplace

Sign in to the AWS Marketplace console, find the iPerf3 listing by cloudimg, and choose Continue to Subscribe, then Continue to Configuration and Continue to Launch. Pick your region, the m5.large instance type, your VPC and subnet, and your EC2 key pair. For the security group, allow SSH (22) from your management network and add a custom rule for TCP 5201 and UDP 5201 from the networks you will test from. Then Launch.

Step 2 - Launch from the AWS CLI

You can also launch the AMI directly. Replace the AMI id, key name, subnet and security group with your own:

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <your-key> \
  --subnet-id <your-subnet> \
  --security-group-ids <your-sg> \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=iperf3}]'

Open the iPerf3 test port on the security group for the networks you test from (TCP and UDP 5201):

aws ec2 authorize-security-group-ingress --group-id <your-sg> --protocol tcp --port 5201 --cidr <your-cidr>
aws ec2 authorize-security-group-ingress --group-id <your-sg> --protocol udp --port 5201 --cidr <your-cidr>

Step 3 - Connect to your instance

ssh ubuntu@<public-ip>

Step 4 - Confirm the server is running

systemctl is-active iperf3.service
ss -tln | grep ':5201'
iperf3 --version | head -1

The service reports active, the server is listening on port 5201, and the iPerf3 version is printed:

active
LISTEN 0      4096               *:5201            *:*
iperf 3.16 (cJSON 1.7.15)

Step 5 - Retrieve your server details

The first boot writes a details file with this instance's public IP, the port and ready-to-paste client commands:

sudo cat /root/iperf3-server-info.txt

# iPerf3 - generated on first boot by iperf3-firstboot.service
# This instance runs an iPerf3 throughput server on TCP/UDP 5201.
IPERF3_SERVER_IP=<instance-public-ip>
IPERF3_SERVER_PORT=5201
#
# Test download throughput from a client machine that has iperf3 installed:
#   iperf3 -c <instance-public-ip> -p 5201
# ...

Step 6 - Run a throughput test

On any machine that has iperf3 installed (apt install iperf3, brew install iperf3, or the Windows build), run a test against the server's public IP. You can confirm the server end to end from the instance itself with a loopback test:

iperf3 -c 127.0.0.1 -p 5201 -t 3

- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-3.00   sec  12.9 GBytes  37.0 Gbits/sec    0             sender
[  5]   0.00-3.00   sec  12.9 GBytes  37.0 Gbits/sec                  receiver

iperf Done.

From a remote client, replace the address with the instance's public IP and choose the direction and protocol you need:

# download (server -> client)
iperf3 -c <public-ip> -p 5201
# upload / reverse (client -> server)
iperf3 -c <public-ip> -p 5201 -R
# UDP at a target bitrate, reporting jitter and packet loss
iperf3 -c <public-ip> -p 5201 -u -b 100M
# parallel streams for high-bandwidth links
iperf3 -c <public-ip> -p 5201 -P 8

Each run prints per-second throughput and a final sender and receiver summary.

Security and maintenance

iPerf3 has no authentication, so anyone who can reach port 5201 can run tests against your instance and consume bandwidth. Restrict inbound 5201 in your security group to the specific source networks you test from, and stop the service when you are not actively testing:

sudo systemctl stop iperf3

Start it again when you next need it with sudo systemctl start iperf3, and restart it with sudo systemctl restart iperf3. Keep the OS patched with sudo apt update && sudo apt upgrade.

Support

This image is backed by 24/7 cloudimg support. Contact us by email and chat for help with throughput testing, multi-region benchmarking, security-group configuration and network tuning.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.