Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 24 replies
  • Subscribers 41 subscribers
  • Views 7209 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Intrusion Prevention (IPS) high cpu usage - Snort

Simplified Sam

Hello,

in our company we got about 60-80 users. Each department got his own vlan running over one port.

XGS2100 (SFOS 19.0.1 MR-1-Build365)

Over the year i was setting up the sopho xg and adding all Firewall rules, like all department are in one zone and got a any rule to our servers with the specific ports needed. (Each server his own rule) . I think i am about 80-85 rules now for evrything. (Yes i am using zones to group the departments atleast.)

Now most of them got ips and the other stuff activated (AV/WEB/APP/IPS/LOG) but even after using the predefined ips rule (LAN TO WAN and LAN to DMZ) in hope to reduce some stress, the cpu usage is still high.

I readed some does not use all this to lan to dmz? is that good? My thinking is, if user gets infected like over mail, and using thang a exchange vulnerability, i got atleast my sophos with ips and zero day, right?

Usally at in break times, but sometimes also between them. You can always see in the Dignostic Graph a high cpu usage. The whole network get than sloppy and sometimes disconects applications, thats hell for running teams meeting and remote sessions.

Under the command "top" i can see multiple process with snort, which has 99 cpu usage, and i see all cpu most of time at 100.

All pattern should be up to date (intervall set to high). Ips Settings max packages 8 is still there.

Now my questions:

Is our sophos to small? Frankly speaking this got worse some months ago maybe at start of september, but maybe when we got the upgrade from version 18.xx to 19.xx.

Can i optimize the ips profiles?

My problem no matter where i look i cant find a good documentation what all categories means (like misc, scan) sure i can click os-windows, or server and client.

Are "clients" only win 10 ? Or does that mean which direction the attack is happening?

If i look at the lan to wan ips template,firstly you see many entrys like OS-windows, then browser, then windows clients and then all clients?? What does that mean all clients? Why are there entries before for windows/linux if i got entry for all clients? Is there difference or is it for the purpose i use it as template and delete what i dont need?

My biggest problem right now is, that i am missing the tools to investigate further, the reporting would be usefull if you could specifc a time, but no you can always do only days.



This thread was automatically locked due to age.
  • 0 in reply to Simplified Sam

    of course you can do this for a test. but I would not let it run disabled.

    did you check from your counters if any other counters than CPU load are high when CPU is high? Memory, Network, etc. If you have no other spikes than CPU this would look more like a config issue oder firmware bug.

  • 0 in reply to LHerzog

    Sometimes the lan port was a bit high like 750 mbits, and yes you had spike on WAN but mostly only one at break and not so long as break (Mostly one short big spike, and cpu usage was much more and longer).

    I never read anywhere what is reccommend to enable and what not. I think ips is important, but what does ATP do what ips does not? The documentation of ATP is very incomplete. (And the options looks to simple for me?)

    https://docs.sophos.com/nsg/sophos-firewall/19.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/AdvancedProtection/AdvancedThreatProtection/index.html

  • 0 in reply to Michael Dunn

    I am testing it right now, we had about 40 web exceptions where i missed the ^ at the start. So basically what u wrote.

    I hope the rules still works but so far, it looks pretty good!

    Are there any recommendation left? Sometimes i use whole ip adress subnets, or specif domains or subdomains, like:

    example\.com/?

    subexample.domain\.com/?

    8.8.0.0/16

  • 0 in reply to Simplified Sam

    IPS checks for traffic behaviour against SNORT rules while ATP checks destination IPs/FQDN to be known botnet / CnC Servers.

  • 0 in reply to LHerzog

    So ATP basically is like Blacklist for known host, and i thought it would scan more like endpoint client would do. And ips only scan for known threats inside of the package.

    So sophos xg has no protection against new threats am i seeing this correct? Like a modifed virus/ransomware?

    Would you recommend ATP to be enabled? Or does this add load of cpu usage?

  • 0 in reply to Simplified Sam

    from my point XG/S does not some kind of "smart" or heuristic scanning. It is only rules and pattern signatures. I cannot remember seeing different Ads by Sophos.

    I would strongy reccomend letting ATP enabled - this helps you to identify already inside threats. we've only very few false positives. it causes extra load but as written earlier - your appliance looks ok for your environment.

    on the other hand i ask myself why intercept X clients do not block those connections on the clients at first.

  • 0 in reply to LHerzog

    Thats my question too, but thanks for the clarification. Now maybe last question, what does the sophos ATP sees as trusted content?

    Like Microsoft?

  • 0 in reply to Simplified Sam

    I do not exactly understand - ATP are patterns managed by Sophos. Frequently updated. Those are blacklists.

  • 0 in reply to Simplified Sam

    If you do:
    example\.com/?

    It will search this url:
    example.com.fakesite.com/fooledyou/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii//aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii//aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii//aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii//aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii//aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii//aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii//aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaabbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbccccccccccccccccccccccccccccccccccc/ddddddddddddddddddddddddddddddddddddddeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeefffffffffffffffffffffffffffff/ggggggggggggggggggggggggggggggggggggghhhhhhhhhhhhhhhhhhhhhhhh/iiiiiiiiiiiiiiiiiiiiiiiiii/example.com/jjjjjjjjjjjjjjjjjjjjjj/

    It would start the search at the front of the string and start the matching, first the e then the x.  However at the end the of the .com there would not be a ending / so it gives up on that match.  It then try to match to anywhere else in the 2400 byte url and eventually it would find the example.com/ that exists in the path and apply the exception.

    If you do:
    ^example\.com/?

    Then it limits the search only the beginning of the string.  When there is no / it gives up and stops.  Which is both safer (more accurate) and faster.

    For a bigger example of a performance gain consider this url
    somerandomsite.com/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/1234567890/

    If you do:
    ^example\.com/?

    It does one match attempt - the first character s does not equal e, so it gives up on trying to match anything else.

    If you do:
    example\.com/?

    Then after s != e it goes to the next character and o != e, etc.  So it has to do ~2000 comparisons to determine if the regex matches, instead of 1.  And that is to find a "not a match" which 99.99% of URLs will be.

    Out of curiosity I tried pumping an example into regex101.com.  This only gives performance numbers on matching, not non matching.  But matching a url at the beginning of a 2000 character string took "13 steps, 0.00ms" and next the end took "529 steps, 0.1ms".


    You should also note in this:
    ^[A-Za-z0-9.-]*\.sophosxl\.net/

    The first [A-Za-z0-9.-]* effectively is "any number of any character that is valid in a domain name" but it does NOT include /.  Therefore as soon as the first / is found (indicating path) this wildcard match stops.  If you were to replace it with ^.*\.sophosxl\.net/ you would be in the same boat as before and searching the entire url.

    The above example requires ".sophosxl.net" so it matches subdomains but not the main domain name.  Most people probably want to use this format, which makes the subdomains optional.

    ^([A-Za-z0-9.-]*\.)?teamviewer\.com/?


    If you are more curious about regex performance you can google it.  I bet there are even courses on this.

  • 0 in reply to Simplified Sam

    To answer the other part of the question I missed:

    8.8.0.0/16

    If you mean the ip addresses as the hostname in a url:

    8.8.1.2/path/resource

    Google "regex to match ip range".  Note: there are some differences in flavors of regex, the XG may not support a cut&paste from some random website that may be using a different variant.

    If you mean actual IP addresses then don't use regex on the url, the exceptions support destination IP addresses (and include CIDR ranges).

Unfiltered HTML