Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SFOS 16.05.0 GA IPS set maxpkts size question

We are having some problems with a XG-430 in bridge mode, which is deployed as an IPS to replace an old Sourcefire appliance. Performance starts to go down after 200Mbps, and really goes bad when it passes 400Mbps. This is bad news for us since we currently get sustained 800Mbps and can peak to 1.4Gbps (We use 10Gbps SFPs).

We were advised to upgrade from 16.01.2 to 16.0.5.0, were told it made "IPS improvements" and also change the value of  IPS maxpkt size from 8 to 80:

Original (Default):

        stream on
        lowmem off
        maxsesbytes 0
        maxpkts 8
        mmap off
        enable_appsignatures on
        http_response_scan_limit  65535

 

to:

        stream on
        lowmem off
        maxsesbytes 0
        maxpkts 80
        mmap off
        enable_appsignatures on
        http_response_scan_limit  65535

As per some articles in this forum, I am seeing users recommending the opposite, go back to 8, and, as per the old Cyberoam documentation (is it still valid?), maxpkts value is for:

"default - pass first 8 packets of the session of each direction for application classification (total 16)"

... if am reading it correctly, doesn't this increase CPU utilization?

Any ideas, tips, recommendations, etc.? We haven't put the appliance back in-line, just want to minimize the times I have to put the appliance back in-line.

 

Thanks.

R.



This thread was automatically locked due to age.
Parents Reply Children
No Data