Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 10 replies
  • Subscribers 9 subscribers
  • Views 3398 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Is software UTM performance limited?

brimur

Hi all, I am running Sophos UTM Home (currently 9.702-1) for years and have been very happy with it. I have always had it running as a VM in ESXi on a NUC and with IPS running I was limited to about 340Mbps. This was fine since my internet downstream was 100Mbps, then 250Mbps and then 360Mbps.

I have a big brother to the NUC which is a 20-core (3.5GHz) Xeon ESXi server so when my internet connection went up to 600Mbps I moved the Sophos VM to that big ESXi server. The config is the same on both so I didnt have to change anything but I noticed I was still limited to about 375Mbps (vs 340Mbps on the NUC) on the big server. Turning off IPS I was seeing the full 600Mbps.

CPU usage was only hitting 25% when running a speedtest but just to be sure I shutdown the VM and gave it 16GB of RAM (up fom 4GB) and 16 cores (8cores x 2 sockets up from 4 cores x 1 socket), started up the VM and reran the speedtest (various providers) and again hit a limit of around 375Mbps. I turned off IPS and it jumped up to the full 600Mbps.

So I am wondering what is the reason for this? Even if the Home version was limited to 4 cores/cpus, the 4 cores @ 3.5GHZ that should still be more than enough horsepower to do IPS at 600Mbps.

Thanks



This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to Sophos User287

    That's exactly what I did for the few speedtest sites I visit often. The others are subject to the filtering and thus return slower speeds.  I believe I have filters in place in both IPS and web filtering.

  • 0 in reply to Sophos User287

    That's just like cheating; putting exceptions in place just for the speedtest sites so they show good throughput. What you want to have is good throughput overall not just on the speedtest site....

    For that to happen with the single core snort process you need the fastest single-core processor (in terms of MHz) that you can find. But usually if more people are simultaneously using the internet connection, each user can (and will) use a snort core and thus the total throughput could be higher than just the speedtest of 1 user shows.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to Jay Jay

    Another trick is to check from the command line.

    Copy and paste each block instead of just using single lines. 

    First, download the speed test:

    cd /home
    wget https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py --no-check-certificate

    Check the speed with IPS off, and then with it on.

    cd /home
    cc set ips status 0
    sleep 15s
    python speedtest.py
    cc set ips status 1
    sleep 30s
    python speedtest.py

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
Unfiltered HTML