Burp Suite · Job board · Built a visual debugging panel for burpsuite-jobs over the weekend

It took me two weeks of on-and-off digging and plenty of wrong turns. Writing the process down as it happened so the next person spends less time.

# Load test: do not jump straight to the max concurrency.
# Ramp it up, otherwise you miss the knee.
for c in 50 100 200 400 800; do
  wrk -t8 -c$c -d60s --latency http://127.0.0.1:8080/api/feed
  sleep 20
done

What genuinely surprised me was the tail. The average looked great while P99 jumped by an order of magnitude past some threshold. The cause was not burpsuite-jobs itself but our upstream connection reuse — the load test traffic was too clean and hid the long-tail requests.

Worth noting: the official docs do cover this, just in a very inconspicuous spot. I only found it reading the source comments, where the author explains the reasoning — roughly "so that it degrades into predictable behaviour in extreme cases".

The first thing was to collapse the variables. We were changing config and upgrading the version at the same time, and afterwards nobody could say which change caused what. We rolled back to moving one variable at a time, re-ran three times, and only then did the curve settle. Tedious, but not skippable.