OPNsense Forum
Archive => 17.7 Legacy Series => Topic started by: Julien on August 08, 2017, 01:53:32 am
-
Hi Guys,
is this a normal behaviour see fotos the one with enabled intrusion and one without
when the intrusion is not enabled I reach a 1000Mbps/s and when its enables I reach a 20 Mbps/s
is this a normal that the ID kills all my speed?
-
It depends on your hardware, but yes it will slow down dramatically, so just enable the rules you really need to increase performance
-
"kills all my speed" -- no, it shouldn't. this is too low.
-
It depends on your hardware, but yes it will slow down dramatically, so just enable the rules you really need to increase performance
Any suggestions why ?
the HDD is I5/8GB Memory/120SSD Samsung Pro.
I don't believe this should be a issue at all.
when the Intrusion detection is on it uses like 30% of the memory and 7% of CPU and when I turn it off its used 3% CPU and 10% memory.
What do you mean with enable only the rules?
-
Is it possible for you to do a iperf test? There are many public iperf servers available.
Regards,
Bobby Thomas
-
Is it possible for you to do a iperf test? There are many public iperf servers available.
Regards,
Bobby Thomas
I can't seem to find iperf
do I have to install this?
what are the commands to do so ?
-
If you want to do it from the firewall then you need to install it: pkg search iperf - you could always install it on a server (or PC) on your LAN.
-
when the intrusion is not enabled I reach a 1000Mbps/s and when its enables I reach a 20 Mbps/s
is this a normal that the ID kills all my speed?
Is enabling/ disabling ID(P)S the only thing that you do in order to have these differences? It is way-way-way too much of a difference in throughput... :(
-
It does cap your bandwidth a lot with the old 3.* Suricata versions.
I tried the new 4.0 stable on my APU2C2 with Ubuntu 16.04 (PPA package) and it works much much better on something as the APU.
For example:
- OPNsense/PFsense Suricata 3.* with netmap : max 9-11 MB/s - where 17 MB/s is my normal max bandwidth
- Ubuntu 16.04 LTS with Suricata 4.0 with NFQ: max 14-16 MB/s - where 17 MB/s is my normal max bandwidth
Tried using a cabled host using gigabit with: 'wget 'ftp://ftp.nluug.nl/pub/FreeBSD/releases/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso' -O /dev/null'
My advise: wait for Suricata 4.* being embedded in OPNsense/PFsense.
See also; https://suricata-ids.org/category/release/ and especially:
'Under the Hood
A major TCP stream engine update is included. This should lead to better performance and less configuration, especially in IPS mode.'
I know my setup is not a good test situation but I've tested a lot with Snort and Suricata inline and performance hits on my box and I really noticed a better performance.
See for yourself if it is worth the upgrade (also better detection is always welcome ;) )
-
It does cap your bandwidth a lot with the old 3.* Suricata versions.
I tried the new 4.0 stable on my APU2C2 with Ubuntu 16.04 (PPA package) and it works much much better on something as the APU.
For example:
- OPNsense/PFsense Suricata 3.* with netmap : max 9-11 MB/s - where 17 MB/s is my normal max bandwidth
- Ubuntu 16.04 LTS with Suricata 4.0 with NFQ: max 14-16 MB/s - where 17 MB/s is my normal max bandwidth
Tried using a cabled host using gigabit with: 'wget 'ftp://ftp.nluug.nl/pub/FreeBSD/releases/ISO-IMAGES/11.1/FreeBSD-11.1-RELEASE-amd64-dvd1.iso' -O /dev/null'
My advise: wait for Suricata 4.* being embedded in OPNsense/PFsense.
See also; https://suricata-ids.org/category/release/ and especially:
'Under the Hood
A major TCP stream engine update is included. This should lead to better performance and less configuration, especially in IPS mode.'
I know my setup is not a good test situation but I've tested a lot with Snort and Suricata inline and performance hits on my box and I really noticed a better performance.
See for yourself if it is worth the upgrade (also better detection is always welcome ;) )
thank you for your feed back.
i'll wait for the release of the V4,
does anybody knows the release date ?
-
There is a call for testing for Suricata 4.0.0, you can try it if you want.
But in any case, it will hit 17.7.1 next week.
Cheers,
Franco
-
There is a call for testing for Suricata 4.0.0, you can try it if you want.
But in any case, it will hit 17.7.1 next week.
Cheers,
Franco
Thank you Franco,
i have found the link https://forum.opnsense.org/index.php?topic=5595.0;topicseen
i'll start the test on the LAB and report back in case of some errors.
-
Thanks Julien, feedback still very welcome! :)