user8446 wrote

Ericsante,

Did you try clearing the IPS logs to see if your throughput increases? There is a known bug where throughput slows as the IPS logs grow. A workaround to clear the logs:

For the command line in the GUI:

cp /dev/null /tmp/snort/alert.fast (for bridge)
cp /dev/null /tmp/snort/alert (for router)
cp /dev/null/tmp/snort/alert2 (for router)

If you want to set it up as a cronjob use:

19 3 * * 0 > /tmp/snort/alert.fast (for bridge)
19 3 * * 0 > /tmp/snort/alert (for router)
10 3 * * 0 > /tmp/snort/alert2 (for router)

I have mine clear weekly at 3:19am as above right before my update script runs. Adjust for your own preference or needs.

(Thanks roadrunnere42 for the correction)