This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Much slower IPS performance in 9.1x

Hi,

I just up2date'd from 9.006 to 9.105, and I'm seeing much lower throughput.

Previously, I was getting 65mbps from LAN->DMZ, and was easily able to max out my FiOS Internet connection (25mbps down).

Those tests were on 7.509, but I was still easily maxing out my 25mbps connection on 9.0x.

However, after the up2date to 9.105, I am now only getting 16mbps. 'top' and 'htop' show a snort thread using 97% of the CPU.

The CPU is an Atom n270 (single core + HT).
RAM is 2GB;

This thread was automatically locked due to age.

Parents

0 Mark_D_01 over 11 years ago

Hi Barry
I have a 100Mb pipe and have had a lot of what I call "Performance Issues" Since version 8.
Most of those have been solved by only allowing one instance of the IPS to run. For a single Home user (Maybe a heavy power user) I can cripple my box (with default/recommended settings) with a couple of downloads, and if you take into account the hardware it's running on it is sad.
Cancel
Vote Up 0 Vote Down

Cancel
0 ManuelKarl over 11 years ago in reply to Mark_D_01

Hello,

sound interesting, but how can i edit to allow only 1 instance?

Thx in advance,

Manuel
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 ManuelKarl over 11 years ago in reply to Mark_D_01

Hello,

sound interesting, but how can i edit to allow only 1 instance?

Thx in advance,

Manuel
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 apijnappels over 11 years ago in reply to ManuelKarl
Hello,

sound interesting, but how can i edit to allow only 1 instance?

Thx in advance,

Manuel

cc set ips num_instances 1

Command has to be entered through the shell as root
Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.
Cancel
Vote Up 0 Vote Down

Cancel
0 ManuelKarl over 11 years ago in reply to apijnappels

Does this only make sense with just one user?
How 2 do when 2 or 3 users are active?

Each user needs one instance?

Sorry, my box is a Intel Celeron 867 (2x 1.3GHz) with 8GB of RAM.
The Subnets are all vlan's.

Thx,

Manuel
Cancel
Vote Up 0 Vote Down

Cancel
0 ManuelKarl over 11 years ago in reply to ManuelKarl

What about a reboot? Have i always type in the shell-command for ips-sub or is this still active?
Cancel
Vote Up 0 Vote Down

Cancel