first of all there is a known bug with Linux and the 82571 chipsets. Vmware runs off a Linux kernel. This chipset is deprecated by intel and no further fixes are coming. I would use either broadcom or intel i-211 series nics. The 219's are too new for right now. Search for your chipset number I posted about this bug a while back..:) either way with only 5 of you yes you are waaaay overkill and i bet you are getting hit by the clock throttling issues in modern chips i have talked about before(search for my dissertations on that). Go into your bios of the host and turn off all power management. In essence lock the cpu at max frequency. In modern chips this has little to no impact on power usage. I would then put your UTM vm down to 2 cpu cores. You can go 4 if you want to use http proxy. With 4 cores you will get two instances of snort each capable of about 250-450 mbps per thread. If you are successful in locking the clock to max then you can go six cores which with IPS on should allow you to get very very close to 1 gigabit..but only if you have 3 or more simultaneous users. Search for my dissertations on snort as well..:)
↧