This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

50%+ bandwidth reduction with IPS enabled

For some reason starting about 2 months ago when if I have IPS enabled my bandwidth is taking a 50%+ hit. Prior to this I never had problems with this.

I have a 100Mbps pipe and when IPS enabled I maxes out at 35Mbps however with it disabled I hit 70-75Mbps without any issue.

I have never made any changes to the default IPS configuration so I am not sure why this has started to happen.

I am running the Home version of Sophos UTM.

This thread was automatically locked due to age.

0 William Warren over 10 years ago

what is the cpu type and speed? also which nics are you using?

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 kubiac over 10 years ago

I noticed the same Problem.
I'm running Sophos UTM as virtual machine on Proxmox.
I have 100 Mbs but with IPS activated it drops instantly to 55 Mbs.
The amount of active rules is not the Problems. The drop is always +/-50%

I am using an AMD Athlon 5350 APU. It's a quadcore CPU with 2050 Mhz.
The Sophos UTM uses two Realtec Gigabit nics.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago

You ahve a double whammy against you. The AMD apu's show quad cores but they are relaly only dual cores due to a horrid design flaw...which is why intel is wiping the floor with amd chps right now. That and the fact you are using realtek nics(i call them winnics..think winmodems for networks). Even a fast dual core celeron from intel at 2.5ghz or faster will run circles around your current platform. I hate to say it but you need new hardware.

If this less than 25-50 users(depending on which modules you are using) a dual core haswell/broadwell celeron at 2.5 ghz, 8 gigs of ram and either broadcom or Intel(210 shiopset) nics will run circles around your current system.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 kubiac over 10 years ago

In one point you're wrong, this APU is a real quadcore CPU. It's not designed like the Bulldozer CPUs.
With the IPS-Rules I need the CPU is at max. 40% when downloading.
So why is this CPU to weak?
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago in reply to kubiac

In one point you're wrong, this APU is a real quadcore CPU. It's not designed like the Bulldozer CPUs.
With the IPS-Rules I need the CPU is at max. 40% when downloading.
So why is this CPU to weak?

ok it isn't a contruction based core entirely...BUt it is based on a 6 year old design that simply isn't going to go anywhere.  Here's the big kicker:

The average number of instructions executed per clock (IPC) is still below 1 for most client workloads. There’s a certain amount of burst traffic to be expected but given the types of dependencies you see in most use cases, AMD felt the gain from making the machine wider wasn’t worth the power tradeoff. There’s also the danger of making the cat-cores too powerful. While just making them 3-issue to begin with wouldn’t dramatically close the gap between the cat-cores and the Bulldozer family, there’s still a desire for there to be clear separation between the two microarchitectures.

So this thing simply cannot hold a candle to anything.  Even at 100% usage you aren't going to anything worth a crap for performance.  FPU performance is still a huge issue but it's due to other problems of hte design.  There's more resources i used but this summarizes things nicely.

I was wrong about it being based on the construction cores but correct on my recommendation.  The nics are causing some of the issues(because they are winnics they perform most of their work on the main cpu..not themselves.  Take that on top of a 6 year old design with weak FPU performance and an IPC of below one and you have a quadruple whammy against you.

Get new hardware.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 kubiac over 10 years ago

Ok, got it. Thank you for the explanations.
Then I will deaktivate IPS. Without is's running fine.
Strange that this issue came with the last update or so. I always had IPS aktive, not all rules active, an it worked fine.
Onother question: can you tell me, if the Advanced Threat Protection ist working without IPS?

Edit: Is there any benchmark to test the throughput of the UTM?
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago

it will work but not be as effective.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 kubiac over 10 years ago

Ok, good. But what does not as effective in Detail mean?
Can you explain it?
I can not find any details on the web.
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago in reply to kubiac

?

Edit: Is there any benchmark to test the throughput of the UTM?

spleedtest.net and others are a good benchmark. The utm is a software product. it's throughput is based solely on hardware configuration, network configuration, users, and modules enabled.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel
0 William Warren over 10 years ago in reply to kubiac

Ok, good. But what does not as effective in Detail mean?
Can you explain it?
I can not find any details on the web.

ATP is an outbound security technology. it leverages web proxy, dns, and ips to monitor outgoing traffic for evidence of suspicious traffic. If ips is off you take away one of the foundation pillars of the ATP security system.

Owner: Emmanuel Technology Consulting

http://etc-md.com

Former Sophos SG(Astaro) advocate/researcher/Silver Partner

PfSense w/Suricata, ntopng,

Other addons to follow
Cancel
Vote Up 0 Vote Down

Cancel