First you need to be sure that your FWSM is configured to do DNS packet inspection. Try to find out with one of the following commands: show run | i dns show run | b policy show run | i inspect If it is there, that it, move along to the next step. If not, you have to configure it: conf t policy-map "your_policy_map_name" class inspection_default inspect dns maximum-length 512 To check the CPU utilization on FWSM: show cpu usage For the IPerf command to stress the FWSM's CPU with a lot of traffic I recommend the following options (iperf.exe under Windows, iperf under Linux / Mac): iperf.exe -c "ip_address" -p 53 -u -t 10 -i 1 -b 1000M -f m -l 1000 Below you can see the options that I used for IPerf: -c = client (DNS server) -p = port (53 DNS) -u = UDP transport -t = time in seconds (10 sec) -i = refresh time in seconds (1 sec) -b = bandwidth (MBytes) -f = format to report for bandwitdh (Mbits) -l = buffer length to write / read 1000KBytes IPerf support many more options. You can find them by typing iperf.exe -h under Windows or iperf -h under Linux / Mac.