2. Was that with a single connection / client, or multiple? I'd expect higher than 150mbps if you have multiple simultaneous client/server connections, assuming a modern CPU.
9.2 (in beta) will supposedly have some IPS performance improvements, but I wouldn't expect an enormous boost. The simple fact is that IPS is very CPU-intensive. A faster CPU would help, to a point.
I know there are physical limitations, but in the graphs was not my CPU to the limit, and even then DROP received messages (dmesg), is there any way to improve or further optimize the resources in this case?
[ 7254.684594] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.685317] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.685678] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.685690] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.686273] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.687296] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.687760] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.689207] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.690071] nf_queue: full at 2048 entries, dropping packets(s)
[ 7254.690082] nf_queue: full at 2048 entries, dropping packets(s)
Each user opens 4 connections, performing HTTP GETs (TCP) at a given site.
The test consite to simulate up to 15 thousand users.
Another detail, hesitate somewhere stating how many simultaneous connections NEW we can do with Sophos UTM?
ips is totally ghz dependent. 2.4 ghz isn't that fast. 3.0 or higher is best. Also there's a tweak you can do to make sure that you always have the cpu at max ghz instead of throttling down. Modern multi-core cpu's easily throttle back and this also effects ips performance. Also you are going to loose ips performance for other features that are enabled. What other features do you have enabled? 15k users? That's a ton.
first head into the bios and make sure the cpu is set to max performance(max ghz). Then see if that helps. if not reduce the features in use. If not then you simply are pushing too many users through the box for the resources available.
Each user opens 4 connections, performing HTTP GETs (TCP) at a given site.
The test consite to simulate up to 15 thousand users.
Hi,
Do you mind sharing what program and command/option you used to do the test?
I'd like to try it on my systems if it's a free test such as Apache Bench or similar.
Can you tell what # of users performs best, or does it not seem to make a difference?
Another detail, hesitate somewhere stating how many simultaneous connections NEW we can do with Sophos UTM?
