Performance issues with v18 compared to v17.5.

Question

Hi, 
 
 Snort seems to be using way more CPU than before, on v17.5 I'm able to get 30MB/s throughput with generalpolicy on IDS/IPS, while using way less CPU than v18. 
 
 Hardware: Intel J1900, 4GB RAM, Intel 82576 NIC. 
 Sophos XG Home License. 
 
 First picture is with 30MB/s throughput (which is the limit of my Download throughput), second picture has take a while after, using 26MB/s, v17.5:

On v18 the maximum i can get is 18MB/s with the same policy while Snort almost using 100% of the CPU:

I've used Iperf3 to test LAN => WAN throughput. (Iperf3 Server on a 1/1 Gbit/s VPS) 
 
 I noticed that since v18 have the new Xsteam engine, the Snort RAM usage is lower than v17.5. Will increasing to 8GB of ram, (6GB usable), make any difference on it ? 
 
 Thanks,

PMParth · Accepted Answer

Hi Prism, 
 Thank you very much for your trying out v18 EAP. Performance and resource optimization with early v18 EAPs is in progress. Please expect to see improvements in subsequent EAPs. 
 Thank you. Parth.