Storage is the part of a network storage system that buyers think about and the part that least often limits it. A modern multi-drive array can read and write several hundred megabytes per second. The network attached to it, in most households, cannot. Understanding where that ceiling comes from is what separates a device that feels fast from one that feels slower than the external drive it replaced, and the difference is usually a single number on a single port.
Why gigabit Ethernet caps everything
The arithmetic is short. A gigabit link carries 1,000 megabits per second, which after protocol overhead delivers roughly 110 to 118 megabytes per second in practice. That figure is the ceiling for every client sharing the link, and it is well below what two or three modern drives can sustain together. A file that the drives could deliver in twenty seconds takes twice as long, and the storage is blamed for it.
2.5-gigabit Ethernet is the practical remedy and has become the default on current equipment, because it is roughly two and a half times the bandwidth using the same cable and the same connectors. A 2.5GbE path removes the network as the limiting factor for most single-user workloads, and 10GbE removes it entirely. The qualification that catches buyers out is that the improvement applies only when every element in the path supports the same rate: the enclosure's port, the switch, the cabling, and the network adapter in the computer reading the files. Upgrading the enclosure alone changes nothing measurable, which is the most common reason an upgrade appears to have failed.
| Link rate | Realistic throughput | What it supports |
|---|---|---|
| Gigabit | 110 to 118 MB/s | One streamed high-bitrate film, ordinary file work |
| 2.5GbE | 280 to 295 MB/s | Several simultaneous clients, direct video editing from the array |
| 10GbE | 1.1 to 1.2 GB/s | Multiple editors, large transfers where the array is the limit again |
Cabling deserves a sentence because it is the element most often assumed rather than checked. A 2.5GbE link runs over ordinary Cat5e in a domestic installation, and 10GbE generally needs Cat6 or better over the distances a house involves. Where a cable is run inside a wall and cannot be replaced, that consideration decides which rate is available before any equipment is purchased.
The rates quoted here follow the published Ethernet standards rather than vendor claims; 2.5GBASE-T is the specification that made faster-than-gigabit links practical over ordinary domestic cabling.
Where the enclosure is plugged in
The second requirement is topological rather than numeric. In a wired network built around a central switch, the enclosure should be connected to that switch rather than to a router or a mesh node at the edge of the network. Traffic between two devices on the same switch is forwarded locally; traffic that has to traverse an uplink competes for it with everything else on the network, and a cable from a single client to the enclosure that crosses three network devices will not achieve the rate its link negotiates.
Mesh systems complicate this further, because a wireless node in a distant room uplinks over the air, and the enclosure attached to it is therefore reachable at whatever the radio link sustains. Where the enclosure cannot be placed near the switch, the cost of that constraint should be measured before, not after.
Reaching it from outside the home
Remote access is the requirement that turns a storage device into a service, and it is also the requirement most likely to be configured badly. Three approaches exist and they differ mainly in who carries the security burden.
The most direct is a public address on the wide area network with a port forwarded to the enclosure. It performs well and it depends on the address being available at all: many connections, particularly mobile and smaller domestic services, place customers behind a shared address, so the public address is not the household's to forward. Where it is available, the exposure is total - the device's own authentication is the only thing protecting it, and an appliance interface reachable from the internet is scanned continuously and is the most reliable way to lose data.
The second approach is the vendor's relay service. The enclosure maintains an outbound connection to a relay, and the user reaches it through that connection, which means nothing is forwarded and nothing is exposed directly. It requires no public address, works behind shared addressing, and depends on the vendor for availability and for the security of the relay itself.
The third is a virtual private network into the home network, usually terminating on the enclosure or on the router in front of it. It needs no public address in the shared case where the router supports an outbound-relay mode, exposes nothing to arbitrary internet traffic, and places the access decision with the household. It is the arrangement that scales best - once the tunnel exists, every device on the home network becomes reachable rather than only the storage - and it costs the most effort to set up.
| Method | Public address needed | What is exposed |
|---|---|---|
| Port forwarding | Yes | The enclosure's own interface, to all internet traffic |
| Vendor relay | No | Nothing directly; the vendor's service carries access |
| VPN tunnel | No, where outbound relay is supported | Nothing; authenticated clients only |
Where the household connection shares one address between many customers, the mechanism is documented under carrier-grade NAT, and it is why port forwarding is not always available.
v>
One box, or several
The final network consideration concerns restraint rather than throughput. An enclosure can be configured to store files, serve media, route network traffic and run virtual machines simultaneously. That configuration is tempting because it consolidates hardware, and it is a reliability argument in every other direction, because the roles now share a single point of failure. A fault in the smallest of them - a network routing mistake, a container that exhausts memory - takes the storage offline for every device that depends on it, and does so on the evening when someone is trying to reach it from another city.
The arrangement that survives real use assigns one job to each device. The enclosure stores and serves. Routing is done by a router. Media playback is done by a player. It costs a socket and a small amount of power, and it means that a failure in one function is contained to that function rather than propagated to the household's data.
What the storage system is being asked to hold, and how much of it has to survive a failure, is the subject of the NAS buying guide.
Continue reading
What a NAS Actually Does: File Access, Media, Backup and the Limits of Each
File access, media serving, scheduled backup and download duty are four different jobs. Which of them a household gets real value from decides whether the box earns its place.
DIY vs. Prebuilt NAS: Total Cost, Effort and Reliability Compared
A self-built server wins on price per bay and freedom, and loses on support, power draw and the hours it costs. Where the two lines cross, and who should pick which.
NAS Buying Guide: Bays, Drives, RAID and Running Cost Before You Buy
Bay count, CMR against SMR drives, RAID levels and the electricity bill are the four decisions that outlast the specification sheet. Worked through in order.