This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Bandwith Issues Chrome/Firefox/Edge

We have been using Sophos intercept x advanced with MTR for about 6 weeks. Since then, our bandwidth has dropped 90%. We use a gigabit internet connection and have previously achieved the following values ​​in a speed test in the browser: Down: 900MB/s Up: 800MB/s

Now, if we're lucky, we'll get Down: 60MB/s Up: 300MB/s.

We found out that it is due to the following settings:
 If these settings are deactivated, we have full bandwidth when surfing again. But we don't want to leave them disabled. This is not a condition, the support from Sophos is not getting anywhere either. We expected more...


here are the screenshots from the speedtest:

deactivated settings:


activated settings:




This thread was automatically locked due to age.
Parents
  • Assuming all features are initially enabled, if you disable in the client UI the option: "Network Threat Protection": 

    ...the SophosIPS.exe and SophosNetFilter.exe processes, which are child processes of the "Sophos Network Threat Protection" service as shown below exit:

    If you disable "Internet" AND "Web Control" at the client with "Network Threat Protection":

    The "SophosNetFilter.exe" process exits but the SophosIPS.exe process continues (assuming IPS is enabled in policy)

    I guess I'm trying to say that disabling "Network Threat Protection", performs the same action as disabling "Internet" and "Web Control".

    I suspect your problem goes away when the SophosNetFilter.exe process exits?

    This can be achieved by either disabling "Web Control" AND "Internet" OR disabling "Network Threat Protection".

    Can you confirm that only disabling "Web Control" and "Internet" is required?

    The next question is, do you have HTTPS inspection enabled? Is https_decrypt_enabled under:

    HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\[revision]\web_protection

    set to 1 or 0?

    If you disable decryption in policy from Central does the speed return?

  • Hi Sir,

    I can confirm that deactivating Web Control + Internet improves download and upload speed. Https encryption is disabled by default.

  • for a given site that is noticeably slower with the features enabled, out of interest, does it help to exclude the domain(s) as website type exclusions in either the global exclusions or in a specific threat protection policy? This would also narrow things down.

  • Exclusions of for example nperf.com makes no different. But your right with this: Web Control" AND "Internet" OR disabling "Network Threat Protection". If we deactivate only Network Threat Protection we have fullspeed.

    I can not imagine that we are the first customer with this problem. We have quite a few applications running through a browser, if we don't fix this we'll have to consider a return from Sophos.

Reply
  • Exclusions of for example nperf.com makes no different. But your right with this: Web Control" AND "Internet" OR disabling "Network Threat Protection". If we deactivate only Network Threat Protection we have fullspeed.

    I can not imagine that we are the first customer with this problem. We have quite a few applications running through a browser, if we don't fix this we'll have to consider a return from Sophos.

Children