IPS slows down internet connection (Fiber Gigabit)

Question

IPS has been slowing down my internet connection. I have a 1gbps fiber connection, and when i perform a speedtest with ips disabled i get the accurate speed of 985mbps, but when it back again the speedtest shows 240mbps. 
 I have been searching on this forum, and a few posts by Sachin mentioned about tweaking the ips using this manual... 
 https://community.sophos.com/kb/en-us/120329 
 however I could not find anything relating to tweaking the IPS for internet speeds. 
 Please guide.

BAlfson · Answer

There are quite a few threads about this. The measurement you're seeing is about the best one can get when working through Snort as it is single-threaded. If you have a quad-core CPU, you will be able to fill a gigabit pipe with four simultaneous tests from four different devices. If you identify specific sites that you can trust, you can make an IPS Exception for them. 
 Cheers - Bob

apijnappels · Answer

For IPS (snort) the clockspeed of the CPU is the most important; the higher the clockspeed, the higher the throughput. Like Balfson told before, snort only uses a single core for a single connection, so if you're doing a speedtest from one device, this device will only get 1 CPU core. However, the other cores are still available to other users/devices. 
 To get the best possible IPS speed using just 1 device, you have to use a clockspeed as high as you can find/afford. More cores will only help more simultaneous users and can be beneficial in a larger network.