Thread Info
  • State Verified Answer
  • +2 person also asked this people also asked this
  • Replies 19 replies
  • Subscribers 11 subscribers
  • Views 5982 views
  • Users 0 members are here
Options
Suggested

Low speeds and TLS Engine Errors

Andrew Mackenzie

So I've just started using this and am a bit unsure how "FastPath" works exactly and I'll drill into some specifics.

I'm testing this on a gigabit (1Gb/940Mb) connection in both a Virtual Machine and on a custom desktop using the 'SW' package.

VM (VMware) = 

CPU: Xeon E5-2690 @ 2.9GHz (4 Cores Allocated)

RAM: 6GB

-----

SW Appliance =

CPU: Pentium G2020 @ 2.9GHz - 2 Cores

RAM: 6GB

-----

Speeds --

On v17.5 I was hitting about 700Mbps down and 280Mbps Up as Snort on the VM was using a single instance (single thread) and running at 99% during the test. When upgraded to v18 EAP, I'm getting about 150Mbps down and 200Mbps up with still a single Snort instance running at 99%

 

On this custom build box next to me with it running, i got about 550Mbps/550Mbps and saw two instances of Snort running up above 90% (one per core I'm guessing) Multiple instances only ran when a multi-connection test was running

 

At one point during the tests I saw Snort on the custom box rise up then drop down to about 2-5% usage after the first few seconds while the test was running. I may have thought this was 'FastPath' behavior but am unsure.

 

TLS Inspection -- I've been really impressed with this so far and It's going to be really usefull. I'm just pretty much noting a few errors I has while running it. Some applications were encountering errors (downloaders, etc...) and the logs showed "Dropped due to TLS engine error"

Further information I have on "Dropped due to TLS engine error" (Example being discord here in the logs but there were a lot of these for other sites):

  • profile_name="Maximum compatibility"
  • bitmask=""
  • key_type="KEY_TYPE__UNKNOWN"
  • fingerprint=""
  • session="0"
  • cert_chain_served="TRUE"
  • cipher_suite="TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256"
  • sni="discordapp.com"
  • tls_version="TLS version - 1.2"
  • reason="Dropped due to TLS engine error"
  • exception=""
  • message=""

It's not much of a problem as many of the apps that may complain about the TLS drops are easily excluded using the new tools :)

  • 0 in reply to TheBalmasque

    As far as i know, all Command Line Entries / settings on Console are saved in Backup and should be peristent after update.

    But should be tested, if you have time, feel free to try it. 

    __________________________________________________________________________________________________________________

  • 0 in reply to TheBalmasque

    Hi Balmasque,

    These settings will persist through reboot and firmware upgrade :)

    Emile

  • 0 in reply to Emile Belcourt

    Hi,

    thank you for the detailed commands. I will try this later. [Y]

    One question left: Will this setting persists even after an firmware update or i must set up this again?

  • 0 in reply to rfcat_vk

    Hello Ian,

    This isn't a case of "my config shows XYZ it must be ABC", Snort being multi threaded on the XG was one of its foundation blocks for marketing and design back in v15 and v16.

    Emile

    Edit: ah, I'm getting caught up on the difference between multi threaded and multi instanced! But my point still stands, it has been notable youhave been able to dramatically increase your throughput by adding more CPU instances. Now, web downloads are multi socket these days so that's why you will see a direct increase in web performance.

  • 0 in reply to Emile Belcourt

    Sorry, you must have configured it someway that was not obvious to the forum members because there are a number of posts about about snort issues and hitting the limits of 1 cpus.

    People posting their configuration is not the same as showing the cpu/memory and throughput which showed 1 (one) snort max'ed out and not adding additional memory or processes to handle the extra load.

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Emile Belcourt

    Thats how it worked with me:

    console> set ips ips-instance clear (first) (then add below seq.)

    console> set ips ips-instance add IPS cpu 0
    console> set ips ips-instance add IPS cpu 1
    console> set ips ips-instance add IPS cpu 2
    console> set ips ips-instance add IPS cpu 3

    Thanks,

  • 0 in reply to rfcat_vk

    Hi rfcat,

    Snort in XG has always been multithreaded?

    Emile

  • 0 in reply to Billybob

    Hi billybob,

    what you are also saying is that v18 uses a different version of snort to v17, eg this one appears to be multi-threaded like?

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to Emile Belcourt

    Tested this a little further. Installing with 1vcpu on a vm will spawn 2 instances. So they are using one master and a child process. Increased to 4vcpu and the snort instances automatically increased to 5.  One master and 4 child processes. You are correct that each instance is not taking 1GB ram although "top" shows them using 1GB each. I suspect only the master is counted toward memory usage and the child processes just distribute the load among different cpu cores. 

    Tried adding and removing snort instances and its a little counter intuitive. Sophos automatically adds snort instances depending on your cpus but if you want to decrease the instances to remove stress on an under powered processor at the cost of some throughput, you have that capability.

    You have to reboot or restart IPS after each command 

    "Set ips ips-instance add IPS cpu 0"

    "Set ips ips-instance add IPS cpu 1"

    etc. and it will bind the snort instance to that specified cpu and will only spawn one snort instance (master and slave) at a time. You can run the command for each cpu to add more instances or clear to default by running

    "Set ips ips-instance clear" 

    For example running "Set ips ips-instance add IPS cpu 1" on a 4vcpu machine gives me

    console> show ips-settings                                                      
    -------------IPS Settings-------------                                          
            stream on                                                               
            lowmem off                                                              
            maxsesbytes 0                                                           
            maxpkts 8                                                               
            enable_appsignatures on                                                 
            http_response_scan_limit  65535                                         
            search_method ac-q                                                      
            sip_preproc enabled                                                     
            sip_ignore_call_channel enabled                                         
            inspect untrusted-content                                               
                                                                                    
    -------------IPS Instances------------                                          
    IPS CPU                                                                         
     1  1                                   

     

    Wish a dev would enlighten us more on the inner working of certain things once in a while[;)]

     

    Regards

Unfiltered HTML