Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 22 replies
  • Subscribers 9 subscribers
  • Views 7038 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos UTM 9.705-3 Intrusion Prevention

RichardHughes1

Hello,

I appear to be having some trouble with the Intrusion Prevention on my UTM. When I have Intrusion Prevention enabled, my network speeds are reduced dramatically. For example, my WAN connection; with and without Intrusion Prevention enabled:

Enabled - Download: 98Mbps
Disabled - Download: 206Mbps

I have tried changing various settings within Intrusion Prevention (whilst still having it enabled), but this made no improvement in the network speed. I had a look in the live-log whilst trying a speedtest and I had a large amount of this entry:

S5: Session exceeded configured max bytes to queue 1048576 using 1053000 bytes (client queue).

I tried doing some searches online for this but I can't seem to find anything other than it's nothing to worry about... but I'm pretty sure this is telling me what the problem is? Is it possible to increase the max bytes to queue? I'm currently using only 35% of 8GB RAM on this box.

Cheers,
Richard



This thread was automatically locked due to age.
  • 0 in reply to Sophos User287

    Ahhh, I didn't count the 0s correctly before!   Are you still getting max_queued_bytes warnings?

    What are you seeing relative to memcap?

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Yeah still getting max_queued_bytes error. Mind you, I've been increasing it gradually since it was at default and I'm yet to find a setting that it's happy at. Not sure where it's going to stop but at this rate, it wont :)  I'm also running two instances of snort as we have 4 cpu's, it didn't like 3 for some reason, maybe the cpu's are just over worked with 3 but these 330's should be fine.

    memcap is always at the limit has not changed its setting. I'm not ram limited so why it's so hard set is beyond me.

Unfiltered HTML