Bandwidth/throughput problem

Hey Dan,

What speeds do you get with Snort off and on?  You can copy and paste the following bock as root at the command line:

cd /home
wget https://raw.githubusercontent.com/sivel/speedtest-cli/master/speedtest.py --no-check-certificate
cc set ips status 0
sleep 15s
python speedtest.py
cc set ips status 1
sleep 30s
python speedtest.py

Snort is single-threaded, so that's the reason that multiple tests should be run simultaneously to see what total throughput can be with it enabled.  If you're using speedtest.net, you also have some slowdown caused by the web proxy.

Your primary problem is your CPU. !00Mbps is about what I would expect for one test at a time with the 1GHz clock speed of your Dell.  You would be better off with 3+GHz, so you might want to check out the last few pages of the *Unofficial* Hardware Compatibility List (HCL) here.

Cheers - Bob

Hey Bob,

I've done the same sort of test through the GUI ... turning off Web Filtering (which is what runs Snort) and IPS, and then opening an anything-goes rule in the firewall.  In fact, without Filtering off and "anything goes" on, I can't get speedtest.net to run at all.  But I can say conclusively that throughput doesn't change with IPS on or off.

I did do it with your script as well ... sort of ... my machine said "command not found" when I ran the "cc" line, so I just manually turned IPS on and off in the GUI and ran the command-line speed test.  On repeated tests, I'm seeing from 199-249 mbps with the Python script.  Oddly, though, it won't work when I have Web Filtering turned off ... it sits at "Selecting best server based on ping..." for the better part of 60 seconds, then when it finally does a test it goes all the way to Cork and gets 0 download/upload.  This can't be a firewall problem b/c I can ping from the CLI no problem.

As a consequence I can't really trace out whether the problem is my NIC (which I suppose is possible) or something else.  Any idea why it's failing with Web Protection off?  My first guess would have been a DNS failure, except that I can ping manually by domain name which means DNS must work ...

In any case, the download is less than half what I can measure with Speedtest on a direct-connected laptop, but more than twice what I get from units connected to the LAN or WAN.

TBH if the CPU were the problem, I'd expect to see usage get higher than the 25% max I see in the history.  With a dual-core CPU, that implies to me that it's not even maxing a single core.  Is that rationale incorrect, do you think?

BTW, the ethernet NICs are Intil 82546EB chipset, Gigabit copper, in case you're wondering.

Hey Bob,

I've done the same sort of test through the GUI ... turning off Web Filtering (which is what runs Snort) and IPS, and then opening an anything-goes rule in the firewall.  In fact, without Filtering off and "anything goes" on, I can't get speedtest.net to run at all.  But I can say conclusively that throughput doesn't change with IPS on or off.

I did do it with your script as well ... sort of ... my machine said "command not found" when I ran the "cc" line, so I just manually turned IPS on and off in the GUI and ran the command-line speed test.  On repeated tests, I'm seeing from 199-249 mbps with the Python script.  Oddly, though, it won't work when I have Web Filtering turned off ... it sits at "Selecting best server based on ping..." for the better part of 60 seconds, then when it finally does a test it goes all the way to Cork and gets 0 download/upload.  This can't be a firewall problem b/c I can ping from the CLI no problem.

As a consequence I can't really trace out whether the problem is my NIC (which I suppose is possible) or something else.  Any idea why it's failing with Web Protection off?  My first guess would have been a DNS failure, except that I can ping manually by domain name which means DNS must work ...

In any case, the download is less than half what I can measure with Speedtest on a direct-connected laptop, but more than twice what I get from units connected to the LAN or WAN.

TBH if the CPU were the problem, I'd expect to see usage get higher than the 25% max I see in the history.  With a dual-core CPU, that implies to me that it's not even maxing a single core.  Is that rationale incorrect, do you think?

BTW, the ethernet NICs are Intil 82546EB chipset, Gigabit copper, in case you're wondering.

Yeah, Dan, to use cc, you have to be logged in as root.

If you can't get things to work without enabling Web Protection, as it works here with the Proxy disabled.  If this isn't a firewall rule issue (check your log), you might have a DNS configuration issue and want to check out DNS best practice.

Yes, I still think that 1GHz processor is the culprit.  I bet your laptop has a much faster processor.

Cheers - Bob