Snort takes too heavy process at Bridge Mode (Not used IPS in any rule)

Update: This problem is not just bridge mode. gateway mode is same.

Harim,

let us know the answer/status.

Thanks

Case is open. screenshot attached.

But Sophos support engineer does not provide any help. Just keep calm.

Anyway, Solved without Sophos support.

There are two resolutions

1. Disable application classificataion
   console> system application_classification off
2. Change maxpkts value. Default is 80.
   console> set ips maxpkts (low number, likely 1/10 level)

Hi Harim,

How low of a maxpkts would you suggest setting? We'd ideally like to turn off IPS completely, but your application_classification off may be a good workaround instead

Suggest test setting is 8~10

Default is 80.

I set mine to 10, took about 2 minutes to implement and caused the cpu to peak at 26%, normally sits around 4% on a quad core e3.

I set mine to 10, took about 2 minutes to implement and caused the cpu to peak at 26%, normally sits around 4% on a quad core e3.

On v15 the max_pkts was set to 8 by default and during the course they adviced to do not change it. Anyway ips seems to have some performance issue on v16.

Please contact Sachin. See this thread:

And let us know.

Regards

On v15 the max_pkts was set to 8 by default and during the course they adviced to do not change it. Anyway ips seems to have some performance issue on v16

On v16's default value of the maxpkts is 80. [:(]

Hi !

Do you believe that issue(cause) is simple as this (maxpkts 8 raised to 80 in v16) and sophos support/engineers cant resolve it for more than a month ? (in our case)

Im asking because maybe you have more experience with sophos and its support.

Aleks

Aleks,

I am more than convinced that it is a bug and they have to find out how to fix it.

The bug appears only on some system. The Max_packets was set as 8 on v15 and they changed on v16.

So we need to wait for an official answer from Sophos.

This issues occurs on all 3 AMD machines i have it installed to. The other 2 Intel machines do not present this issue.

Ady San good catch yours!

So it seems a compatibility issue with AMD CPU/Chipset.

Did you open a ticket with Support?

Hi Luk,

My customer has similar snort issue, and open a ticket about 1 month later.

But support team doesn't have solution yet...

I want to ask you, how to determinate the CPU/Chipset Type on a XG125 appliance?

Thanks for your help~

Shunze

I want to ask you, how to determinate the CPU/Chipset Type on a XG125 appliance?

If you SSH into appliance and open advance shell you can type dmidecode to output process information.

My appliance has AMD G-T30L processor and also having high snort CPU issue.

We have same issue on XG115, it has Intel Atom inside

You can check it by entering command "cat /proc/cpuinfo" ( inside advanced shell, menu choices > 5 > 3 )

cat /proc/cpuinfo

Intel(R) Atom(TM) CPU  E3827  @ 1.74GHz

I believe that XG125 has something similar, maybe more powerful atom model.

Regards,

Hi ShunzeLee,

all the Sophos XG appliances are Intel CPU based so maybe the 2 issues are not related.

[:(]