This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPS throughput

Hi,

I've installed Sophos UTM Home on an VMWare ESXi server but I have some issues with IPS performance. If I don't enable IPS I get around 450-500 Mbit/s which is expected because that's my downstream. However, if I enable IPS the throughput drop to about 250-260, even if I disable all the signatures.

There are no issues with CPU and memory load, the VM has 4 cores and 4 GB Ram. The CPU load is next to nothing and about 20% of RAM is used.

I've also installed pfSense on the same ESXi and enabled IPS/Snort. pfSense gives me 450-500 Mb/s with IPS enabled.

Is the Sophos UTM Home capped or are there any other known issues?

Best regards,
Tomas

This thread was automatically locked due to age.

Parents

0 Bluedog over 10 years ago

So when is Sophos going to convert to Suricata to finally get multi threaded performance?
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Bluedog over 10 years ago

So when is Sophos going to convert to Suricata to finally get multi threaded performance?
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 William Warren over 10 years ago in reply to Bluedog

So when is Sophos going to convert to Suricata to finally get multi threaded performance?

no idea. Sophos hasn't made anything plans like that known.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago in reply to Bluedog

So when is Sophos going to convert to Suricata to finally get multi threaded performance?

snort is also now in early alpha stages of their own multi-threaded version as well.
https://snort.org/snort3

maybe the cisco purchase is going to be a good thing....
Cancel
Vote Up 0 Vote Down

Cancel