Endpoint slow down internet speed

Question

Hello, 
 We got a dedicated optical fiber 1gb Down/up . 
 With the endpoint installed, the speed download seems to be block around around 150 to 300 mb/s. Upload is correct. 
 IF i uninstall it, then the speed go back to normal with around 900 mb/s. Tests are made through NPERF. 
 I tried a to play with settings on sophos central but none of them seems to make it work normally. 
 Does someone experiencing this issue or does know how to fix it ?

Note: Please see the following Blog Post for the latest update regarding this issue

Intercept X Endpoint &ndash; Web Performance Optimization

Sophos User930 · Accepted Answer

It is worth repeating, that there will always be a percentage decrease when you're doing web scanning and lookups "in-line" for browser process traffic. As you say, this only affects processes classified as browsers, not all processes are subjected to so much inspection hence why application speed test tools are unaffected, web browser tests are. 
 Depending on the config you have, there is: 
 1. Decryption of the browser traffic to be able to inspect HTTPS. 
 This may or may not be on but this is possibly the most intensive feature. HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\Management\Policy\ThreatProtection\[latestrevision]\web_protection\ https_decrypt_enabled = 1 would signify from the endpoint it is enabled. " SSL/TLS decryption of HTTPS websites " is the policy option in Central. 
 2. Scanning the content before it hits the browser, this relies on https_decrypt_enabled being enabled for HTTPS traffic. If it's HTTP, which maybe accounts for 20% of traffic it is still being processed. " Scan downloads in progress " is the policy option in Central. 
 3. Making lookups to SXL to check the domains/urls being accessed. " Block access to malicious websites " is the policy option in Central. Also if Web control is enabled in policy, these lookups are also made regardless of it being for protection to get the category for the site. 
 So when decryption of traffic is enabled, there is more work to be performed, as more data becomes available before it hits the browser to process, plus you have the overhead of the decrypt. At this point lack of CPU power could be a factor as much as internet speed to make the SXL lookups from SSPService.exe. 
 So only when all 3 features: 
 
 "Block access to malicious websites" 
 "Scan downloads in progress" 
 "Web control" 
 
 are off does SophosNetFilter.exe process exit and there is 0 impact on web browser traffic. Of course if you disable "Network Threat Protection", that closes it down as well but that is far more than needs to be disabled. This essentially disables all of the Network Threat Protection features rather than just the protection for the browsers. 
 The Core agent 2022.4 has an improvement in speed but as far as I am aware, this requires the endpoint flag modernweb.offloading.enabled under 
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\EndpointFlags 
 to be set to 1. Sophos slowly rolls the flag out post release to ensure when enabling a new feature or significant change there is no issue with it. So although you might have 2022.4, your account may not have the flag set yet. 
 Hope that helps.

WINEP-42231	Sophos Network Threat Protection	Improved the performance of SophosNetFilter.exe.
WINEP-42552	Sophos Network Threat Protection	Resolved an issue where Web Protection and Web Control significantly affected download speeds for some customers.

WINEP-42231	Sophos Network Threat Protection	Improved the performance of SophosNetFilter.exe.
WINEP-42552	Sophos Network Threat Protection	Resolved an issue where Web Protection and Web Control significantly affected download speeds for some customers.

Endpoint slow down internet speed

Note: Please see the following Blog Post for the latest update regarding this issue

Intercept X Endpoint – Web Performance Optimization

Top Replies