Endpoint slow down internet speed

Top Replies

• 

  Sophos User930 over 3 years ago in reply to listentobro +3 verified

  It is worth repeating, that there will always be a percentage decrease when you're doing web scanning and lookups "in-line" for browser process traffic. As you say, this only affects processes classified as browsers, not all processes are subjected to so much inspection hence why application speed test tools are unaffected, web browser tests are.

  Depending on the config you have, there is:

  1. Decryption of the browser traffic to be able to inspect HTTPS. 

  This may or may not be on but this is possibly the most intensive feature.
  HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\[latestrevision]\web_protection\
  https_decrypt_enabled = 1 would signify from the endpoint it is enabled.
  "SSL/TLS decryption of HTTPS websites" is the policy option in Central.

  2. Scanning the content before it hits the browser, this relies on https_decrypt_enabled being enabled for HTTPS traffic. If it's HTTP, which maybe accounts for 20% of traffic it is still being processed. 
  "Scan downloads in progress" is the policy option in Central.
  

  3. Making lookups to SXL to check the domains/urls being accessed.
  "Block access to malicious websites" is the policy option in Central.
  Also if Web control is enabled in policy, these lookups are also made regardless of it being for protection to get the category for the site.
  
  

  So when decryption of traffic is enabled, there is more work to be performed, as more data becomes available before it hits the browser to process, plus you have the overhead of the decrypt.  At this point lack of CPU power could be a factor as much as internet speed to make the SXL lookups from SSPService.exe.

  So only when all 3 features:

  • "Block access to malicious websites"
  • "Scan downloads in progress"
  • "Web control"

  are off does SophosNetFilter.exe process exit and there is 0 impact on web browser traffic. Of course if you disable "Network Threat Protection", that closes it down as well but that is far more than needs to be disabled.  This essentially disables all of the Network Threat Protection features rather than just the protection for the browsers.

  The Core agent 2022.4 has an improvement in speed but as far as I am aware, this requires the endpoint flag modernweb.offloading.enabled under

  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\EndpointFlags

  to be set to 1.  Sophos slowly rolls the flag out post release to ensure when enabling a new feature or significant change there is no issue with it.  So although you might have 2022.4, your account may not have the flag set yet.

  Hope that helps.
  Jump to answer