I get thousands of this alerts every time I use https://www.speedtest.net/
Does it make sense? how can I disable it or fix the issue?
This thread was automatically locked due to age.
I get thousands of this alerts every time I use https://www.speedtest.net/
I gave up on that site because without an open firewall rule I only received latency errors.
It needs its own rule without http/s scanning because it cannot cope with s proxy.
Ian
XG115W - v20 GA - Home
XG on VM 8 - v20 GA
If a post solves your question please use the 'Verify Answer' button.
I gave up on that site because without an open firewall rule I only received latency errors.
It needs its own rule without http/s scanning because it cannot cope with s proxy.
Ian
XG115W - v20 GA - Home
XG on VM 8 - v20 GA
If a post solves your question please use the 'Verify Answer' button.
I have applied this solution
https://community.sophos.com/kb/en-us/133096
Now not only I dont get those alerts, I have full speed on upload 300Mbps with this setting enabled I got around 260 Mbps and thousands of alerts
Hi l0rdraiden
Thank you for following up and i'm glad to hear you were able to resolve!
It looks like this setting was not related with the slow upload speeds, I still have the upload speed issues, with Pfsense doesn't happen.
Is there any reason on why Sophos XG is able to reach full speed at download but not at upload?
The same happens here
https://www.nperf.com/ but now here http://www.movistar.es/particulares/test-de-velocidad/medir-velocidad
With pfsense+suricata in all those I get full 300/300
Hi l0rdraiden
That depends on how your firewall is configured.
For the firewall rule used for your speed test traffic, how is it configured? Did you have any traffic shaping policies applied?
What's the difference in overhead experienced for upload speeds?
Regards,
For the firewall rule affected I only have web filering.
I only have IPS active in a rule that only affect to a host, so the speed test has nothing to do with it
The only way to get 300 Mbps of upload is if I stop the IPS service completetly in "System Services" -> "Services"
It looks like a wrong implementation of Snort in Sophos XG, how my upload speed can be capped if I dont have the IPS active in any rule?
You might want to remove the web filter as well from the speediest rule.
Ian
Also found that speediest.net goes to a lot of sites that are not part of its FDQN which causes failures if you use their FQDN in the allowed rule.
XG115W - v20 GA - Home
XG on VM 8 - v20 GA
If a post solves your question please use the 'Verify Answer' button.
Hi Flo,
my apologies, I took that comment out after much testing and could not see any changes to my download speeds using speediest.net.
Further my settings for the IPS are not the default, but updated from previous recommendations on how to block some unwanted software/access.
What Idid find was that limiting the speediest.net to its FQDN sites caused it to fail, but no restrictions on download or upload performance.
I will run some more tests with IPS enabled in the speediest rule and report back.
Ian
XG115W - v20 GA - Home
XG on VM 8 - v20 GA
If a post solves your question please use the 'Verify Answer' button.
Update on testing.
My IPS settings had no affect on the speedtest.net performance. I have tuned my IPS policy.
Using http/s as the allowed protocols caused the tests to run very slow with block unknown protocols disabled. Also required an update to flash part the way through the test.
Ian
XG115W - v20 GA - Home
XG on VM 8 - v20 GA
If a post solves your question please use the 'Verify Answer' button.