Intrusion Prevention

Hi, can you post a link to a youtube video that is being blocked? 

Also in your intrusion detection options, have you changed the source and destination packets/second or are they at 200 and 300 respectively?

Also is web filtering turned on and is the web filtering blocking anything when you try to watch a youtube video?

https://youtu.be/Bey4XXJAqS8

Thankyou. I can confirm that there is indeed a UDP flood attempt when playing this video on Chrome, but it plays fine on Firefox. My webfilter log shows nothing being blocked. But my intrusion prevent log shows this:

2018:05:25-13:57:15 mysophosutm ulogd[19751]: id="2105" severity="info" sys="SecureNet" sub="ips" name="UDP flood detected" action="UDP flood" fwrule="60013" initf="eth0" srcmac="00:01:5c:8a:3c:46" dstmac="68:05:ca:58:20:28" srcip="172.217.129.41" dstip="XX.XX.XX.XX" proto="17" length="1378" tos="0x00" prec="0x00" ttl="58" srcport="443" dstport="56959"

Occasionally Chrome has issues playing HD Youtube videos and clearing the cache helps, but in this case the UDP flood detection is blocking the video from loading but it plays fine on Firefox.

Using Chrome notice the connection speed...

Using Firefox same video is perfect, notice the connection speed.

Hi Alan

No I have not changed the source and dest/s they are at default value.

I have an exption to not web filter my PC .

thanks

That's because the intrusion detection system is blocking most of the packets for whatever the reason..

Someone posted this on a google products help forum:

https://productforums.google.com/forum/#!topic/chrome/9x4trkWwVN4

Just for anyone else that happens to search this, mainly fellow sysadmins: If you are having issues with all Google services loading slowly in Chrome, another issue is that when using the QUIC protocol, some firewalls will see the traffic as a UDP flood due to the way QUIC uses HTTPS over UDP. Disabling QUIC in this case will solve the issue, or figuring out how to exclude Google services in your firewall from seeing QUIC as a UDP flood. You can disable QUIC in chrome by going to chrome://flags and setting QUIC to disabled

Thank you Alan , that did the trick .