Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 13 replies
  • Subscribers 2 subscribers
  • Views 45027 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Much slower IPS performance in 9.1x

BarryG
Hi,

I just up2date'd from 9.006 to 9.105, and I'm seeing much lower throughput.

Previously, I was getting 65mbps from LAN->DMZ, and was easily able to max out my FiOS Internet connection (25mbps down).

Those tests were on 7.509, but I was still easily maxing out my 25mbps connection on 9.0x.

However, after the up2date to 9.105, I am now only getting 16mbps. 'top' and 'htop' show a snort thread using 97% of the CPU.

The CPU is an Atom n270 (single core + HT). 
RAM is 2GB; 


This thread was automatically locked due to age.
Parents
  • 0
    Hi Barry
    I have a 100Mb pipe and have had a lot of what I call "Performance Issues" Since version 8.
    Most of those have been solved by only allowing one instance of the IPS to run. For a single Home user (Maybe a heavy power user) I can cripple my box (with default/recommended settings) with a couple of downloads, and if you take into account the hardware it's running on it is sad.
  • 0 in reply to Mark_D_01
    Hello,

    sound interesting, but how can i edit to allow only 1 instance?

    Thx in advance,

    Manuel
  • 0 in reply to ManuelKarl
    Hello,

    sound interesting, but how can i edit to allow only 1 instance?

    Thx in advance,

    Manuel


    cc set ips num_instances 1
      

    Command has to be entered through the shell as root

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels
    Does this only make sense with just one user?
    How 2 do when 2 or 3 users are active?

    Each user needs one instance?

    Sorry, my box is a Intel Celeron 867 (2x 1.3GHz) with 8GB of RAM.
    The Subnets are all vlan's.

    Thx,

    Manuel
  • 0 in reply to ManuelKarl
    What about a reboot? Have i always type in the shell-command for ips-sub or is this still active?
Reply Children
No Data
Unfiltered HTML