ISP bandwidth is cut in 1/3 due to Suricata Intrusion detection IPS Mode

[sonic1812]

I have an opnsense running the following:
Board N100
Ram 32 GB
SSD:528
Version   25.7.11_2   
Architecture   amd64

With IPS mode OFF on suricata, I get 1300 mbps on speedtest
With IPS mode ON, I get ~500 mbps on speedtest.
I have all the hardware filtering settings on Interface turn OFF. See attached.

How can I get my provisioned bandwidth of 1300 mbps with IPS Mode ON?

[meyergru]

IPS mode is a lot more taxing than just routing and firewalling. And RSS mode is not applicable, because IPS is inherently single threaded, see the note here: https://docs.opnsense.org/troubleshooting/performance.html

The hardware settings will do next to nothing, if they work at all. Some seem to work first, with some subtle problems coming up later.

So, essentially, the answer is: Use a CPU with more single-thread punch.

[Greg_E]

Suricata should be multithreaded, it definitely was when I was running it on pfsense, and I'm guessing it is on OPNsense. Snort was single threaded for a long time, I think they may have fixed this by now (but not sure).