Bandwith Issues Chrome/Firefox/Edge

Assuming all features are initially enabled, if you disable in the client UI the option: "Network Threat Protection": 

...the SophosIPS.exe and SophosNetFilter.exe processes, which are child processes of the "Sophos Network Threat Protection" service as shown below exit:

If you disable "Internet" AND "Web Control" at the client with "Network Threat Protection":

The "SophosNetFilter.exe" process exits but the SophosIPS.exe process continues (assuming IPS is enabled in policy)

I guess I'm trying to say that disabling "Network Threat Protection", performs the same action as disabling "Internet" and "Web Control".

I suspect your problem goes away when the SophosNetFilter.exe process exits?

This can be achieved by either disabling "Web Control" AND "Internet" OR disabling "Network Threat Protection".

Can you confirm that only disabling "Web Control" and "Internet" is required?

The next question is, do you have HTTPS inspection enabled? Is https_decrypt_enabled under:

HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\[revision]\web_protection

set to 1 or 0?

If you disable decryption in policy from Central does the speed return?

Hi Sir,

I can confirm that deactivating Web Control + Internet improves download and upload speed. Https encryption is disabled by default.

for a given site that is noticeably slower with the features enabled, out of interest, does it help to exclude the domain(s) as website type exclusions in either the global exclusions or in a specific threat protection policy? This would also narrow things down.

Exclusions of for example nperf.com makes no different. But your right with this: Web Control" AND "Internet" OR disabling "Network Threat Protection". If we deactivate only Network Threat Protection we have fullspeed.

I can not imagine that we are the first customer with this problem. We have quite a few applications running through a browser, if we don't fix this we'll have to consider a return from Sophos.

Yes. That’s what I expected. Web protection and control are sub-features of the Network Threat Protection component. If you disable the parent it disables the the child features. So you should equally be able to leave Network threat protection enabled and just disable web protection and control to restore speed.

Interesting about the exclusions. I suppose that suggests it’s the overhead is not scanning or lookups but the change in process flow.

Disabling it is not a solution, as employees will then no longer be warned about malicious websites.

I’m not suggesting that. Just trying to narrow down the specific feature within the NTP component. I think this is one for Support/Dev. 

Can confirm this as well, at times user's browers become completely unresponsive with heavy web load (marketing departments/heavy social media users) we have had to disable Web Control functions and Internet as a work around, which is just not acceptable  

We have the same issue and also at random towards the end of the day all web browsing stops working on random machines even though nslookup/ ping / network access etc still works fine

Are your problems solved?

Are your problems solved?

No, apparently there is a known issue where Sophos uses up all the free memory which in turn stops browsing from working and the developers say it is something they are working on which will be in the next release.

I can confirm this on several Windows 10. Waiting a fix too.

We have just swapped over users with an issue to use Microsoft Defender for Business and found all their issues stopped straight away (intermittent wifi loss and reconnection/ random blue screens caused by network card/ internet speeds tested when on Sophos 140mb up to 190mb on Defender / and system average load on the CPU down about 10 - 15%.