Snort takes too heavy process at Bridge Mode (Not used IPS in any rule)

Question

Snort takes too heavy process at Bridge Mode (Not used IPS in any rule). 
 It communicate of clients delayed & lose that under the Sophos appliance. 
 Check please. 
 HW Appliance SG105 ~ SG135 
 v16.01.1 ~ v16.01.2

FoW · Accepted Answer

Update: This problem is not just bridge mode. gateway mode is same.

FoW · Answer

Case is open. screenshot attached. 
 But Sophos support engineer does not provide any help. Just keep calm. 
 Anyway, Solved without Sophos support. 
 There are two resolutions 
 
 Disable application classificataion console> system application_classification off 
 Change maxpkts value. Default is 80. console> set ips maxpkts (low number, likely 1/10 level)

Aditya Patel · Answer

HI Harim , 
 If you have not applied IPS on any of the firewall rule , then you may have applied Application filter .

Aditya Patel · Answer

HI All, 
 I may have a Work aournd by changing the IPS settings , 
 Default IPS settings 
 stream on lowmem off maxsesbytes 0 maxpkts 100 enable_appsignatures on http_response_scan_limit 65535 
 Run Commands on Console 
 set ips maxsesbytes-settings update 8192 set ips maxpkts 8 
 IPS settings after changes 
 -------------IPS Settings------------- stream on lowmem off maxsesbytes 8192 maxpkts 8 enable_appsignatures on http_response_scan_limit 65535 
 This should help

Aditya Patel · Answer

HI Dave, 
 
 If the application classification is turned off, then it would not identify which application is processed . No Doubt this will reduce the SNORT load but you may need to reconsider when you are using application filter .