EAP 2 - Ram Utilisation

My RAM usage is around 39% in EAP 2. On Sophos XG Home, 8GB on system -  6GB usable.

After i found out Snort on XG supported hyperscan, and my NIC chipset also supported, I've decided to give it a try. RAM usage has lowered in 1GB after this change.

Prism said:

My RAM usage is around 39% in EAP 2. On Sophos XG Home, 8GB on system -  6GB usable.

After i found out Snort on XG supported hyperscan, and my NIC chipset also supported, I've decided to give it a try. RAM usage has lowered in 1GB after this change.

How come you're limited to 6GB usable? I'm on a Sophos XG Home license as well but with EAP, I'm able to utilize all 8GB.

How do you enable hyperscan?

shred said:

How come you're limited to 6GB usable? I'm on a Sophos XG Home license as well but with EAP, I'm able to utilize all 8GB.

By default the Home License is limited to 6GB of ram, but apparently on EAP there's no RAM or CPU Limit, since i has able to use 8C/16GB on a VM.

shred said:

How do you enable hyperscan?

If you have a Intel CPU and Intel NIC, you can enable it by running: "set ips search-method hyperscan" In the XG Console.

And then check if it has enable with: "show ips-settings"

There has a noticeable performance improvement with it, and also an huge RAM usage decreased by Snort. Which are both expected with Hyperscan.

Thanks. Mine was defaulted to the "search_method ac-q". I enabled hyperscan and my RAM utilization dropped from 48% to now 35% (also running 8GB of RAM).

From memory if you used the upgrade from v17 memory cap changed, but if like me you did rebuilds using the ISOs the home licence memory cap remained at 6gb.

Ian

What are the trade-offs for using hyper scan?

Ian

Ian,

more info can be found here.

http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node16.html

In the link, search for "search-method"

Regards

rfcat_vk said:

What are the trade-offs for using hyper scan?

There's no trade-offs,

Hyperscan have a lower memory footprint and higher performance, if implemented correctly with Snort you could see almost 6x higher performance with it. And using at the same time 1/3 of the memory.

But i'm not seeing that huge difference with XG. I'll take this weekend to test the actual difference.

Here's a good read on it.

rfcat_vk said:

What are the trade-offs for using hyper scan?

There's no trade-offs,

Hyperscan have a lower memory footprint and higher performance, if implemented correctly with Snort you could see almost 6x higher performance with it. And using at the same time 1/3 of the memory.

But i'm not seeing that huge difference with XG. I'll take this weekend to test the actual difference.

Here's a good read on it.