Web Shield significantly impacting network speed - or just the test??

[elzar]

I'm setting up a new laptop and was testing both it's wireless and wired 'net connection as is (PC out of box, not yet setup/reformatted by me).  I am first just exercizing the new beast, making sure all the hardware works b4 repartitioning/reformatting/iinstalling a new hard drive/tons of other things.

As part of all this I am running a companion network speed test on my desktop PC as a benchmark and I noticed that my desktop (with AVAST webshield running) is getting terrible #s via http://www.speakeasy.net/speedtest/.

I have a 20mbs down/5mps up connection.

I usually benchmark pretty close to that.  My new laptop is doing fine around those numbers on both wireless and wired, connected to the same router.

But my desktop is crippled by a factor of 2.  I'm only getting like 10,000/2000 (or LESS!), unless I disable webshield.  If I disable Webshield the test #s are fine.  If I enable it, set it to Normal, High, or even "Custom" and tell it to only look at "exe, com" extensions, my network test #s are terrible.

I don't recall this being that significant of a dropoff in the past, but I do think it had a minor impact.  Now though, it is pathetic.

What I'm wondering is:

- is this impact just on the TEST itself (which uses flash somehow) or on all my 'net connectivity?

- or has something changed with webshield that now it is killing my 'net connection?


I have a lot of work to do on the laptop b4 I can install Avast but after I do that I will repeat the speed tests and see what the impact is on that machine as a sanity check.

I am running winxp home SP3, avast 4.8 home, pentium 4, 1gb ram, on the desktop.

Any comments, ye Avast experts?

THANKS.

[RejZoR]

Well, i never noticed any slowdowns by Web Shield. But i've heard several stories how bandwidth was cut.
I don't see how unless ISP is using some weird way of transfering data.

[elzar]

If you're game, please try your own speedtest at http://www.speakeasy.net/speedtest/, with webshield on vs off & see what numbers you get.

I'd really like to get an answer for this if possible.   Maybe if enough people notice the same problem it can be diagnosed/answered.

My ISP is Verizon Fios btw.

I don't have my new laptop setup with XP yet (long story) but once I do I will try the test on that.

[mathboyx215]

Why don't you try to download a 50meg file with web shield on and off and see if there is any difference in download speed.Remember to delete the file after each download.
Also,I did a speedtest with web shield on and off and the results were about the same.

[RejZoR]

I have a 4Mbit/1Mbit VDSL2 connection. I've used http://www.speedtest.net for testing.

With Web Shield:
3,80 Mbit DL
0,95 Mbit UL

Without Web Shield:
3,85 Mbit DL
0,96 Mbit UL

So, the difference is really negligible.

[Sammo]

I got a better performance by selecting the custom setting and choose to filter only the most common web file types. This way Web Shield isn't filtering everything, just the usual suspects for files. My speed at Speakeasy went back to normal afterward. You should also make sure that you have your browser proxy settings to 127.0.0.1 port 12080.

[elzar]

I setup Avast on my new laptop & did some tests, and on that machine the differences with webshield on/off are negligible.

Repeating tests again on my desktop, the results are severe - my download speed is consistently cut in half!!!!

I turned logging on for Webshield for both machines & can see that Avast is looking at things on both, so it is not like on the laptop it isn't doing anything.  There is something about my desktop, either something wrong with Webshield causing it to have this significant impact, or maybe it is just related to the resources available to Webshield on the desktop causing it to not cause this type of slowdown.

My desktop is an old Pentium 4,1.7 gHz, with 1 gb RAM.   Does anyone know if this type of processor/resources are not enough to run Webshield without significant impact??

I have some other points/questions but I want to do some of those as replies to the newer posts.  Thanks guys!

[elzar]

I got a better performance by selecting the custom setting and choose to filter only the most common web file types. This way Web Shield isn't filtering everything, just the usual suspects for files. My speed at Speakeasy went back to normal afterward.

Can you give me some hints as far as what filetypes to put in there?

I changed it to EXE and COM and it doesn't impact me much anymore on this desktop, but I don't think that is correct to mention those filetypes as far as web scanning goes, and I wonder if I do that if I am basically doing the same thing as totally crippling Webshield altogether. 

Do you mean like .HTML files (or what)?   Also I thought the Webshield was supposed to be screening out things like javascript attacks - how do you set it for that kind of thing on "customize" correctly?

Speaking of which, the "scan files of selected type only" dialogs lets you input file types, and also has a window for "files of the following MIME types" with an add button for "object content type".  Any clues as to what I should be putting in there?

You should also make sure that you have your browser proxy settings to 127.0.0.1 port 12080.

Is that something to set in the browser(s) or in Webshield? And what does that do?  I think 127.0.0.1 means local ethernet loopback address but what is port "12080" and what are you accomplishing by having that setup a "proxy" somewhere?




And since I am on a quest now to figure this out (if possible I would still like to use Webshield on my desktop, but not if the cost is at half of my download bandwidth), I'd like to ask about some other Webshield settings.  Maybe one of these is not right, or requires too many resources for this PC, and it would still work OK with these set different?

On the Webshield "basic" tab:
- what does "enable web scanning"  do? (i assume if you uncheck this then it is like turning webshield off???)

- what does "use intelligent scanning" do?

- what is the function of the bottom half of that tab where it talks about setting up "transparent web scanning" and it has port 80 configured as "redirected http port"?

- i assume the checkbox on the bottom for "ignore local communication" means that traffic with the local network (as opposed to internet) won't be scanned

THANKS for any clues!


P.S. Also, something interesting to mention, just turning on the logging function of webshield (advanced tab, "show detailed info on performed action") is very interesting.  Just leaving the browser doing nothing I've gotten some things coming up by themselves on my laptop having to do with google or whatnot.

[Sammo]

You may want to start by filtering these (Web Shield - Customize - Web Scanning): HTML,HTM,EXE,COM,ZIP,PDF,TXT

As for the proxy settings, if you are using Firefox: Options - Advanced - Network - Settings (see attached graphic).

[Lisandro]

Why TXT

[elzar]

You may want to start by filtering these (Web Shield - Customize - Web Scanning): HTML,HTM,EXE,COM,ZIP,PDF,TXT

As for the proxy settings, if you are using Firefox: Options - Advanced - Network - Settings (see attached graphic).

Thanks but - Can you please explain what those proxy settings are doing/what they mean??

I tried setting that (with no idea of what it is doing) and find that with that set Firefox cannot connect to any websites at all.  I get these error messages:

"   Proxy Server Refused Connection

    Firefox is configured to use a proxy server that is refusing connections.

    The browser is configured to use a proxy server, but the proxy refused a connection.

       * Is the browser's proxy configuration correct? Check the settings and try again.
       * Does the proxy service allow connections from this network?
       * Still having trouble? Consult your network administrator or Internet provider for assistance."


I'm guessing that you must have something specific setup elsewhere on your PC, or your network, or your router, or your firewall, or SOMETHING, that routes usual internet traffic like web browsing to this other port???     Although I don't understand what you are doing with this of course.  And what is it about this that is supposed to help Webshield anyways?  Can you explain this, and assume I know NOTHING about what it is you are trying to accomplish with this proxy thing, and you'll be right ;-)


Also as an aside - something strange to mention about Firefox and doing the speakeasy speedtest on my desktop PC.  I never get proper #s when doing the test with Firefox (and have no idea why) - they are always on low side.   It only seems to work "right" with Internet Explorer (again I have no idea why although I think it has something to do with how the test has something to do with flash and in IE it is implemented via ActiveX whereas in Firefox it is some kind of "plugin"). 

However even in Firefox I can see a crippling effect when running Webshield.   Note that the connection speed I am paying for is 20Mbs down and 5Mbs up.   Which confusingly equals 20000kbps down and 5000kbps up, or 2500KB/sec down and 625 KB/sec up, to put it in the same language as the speakeasy benchmarks.


With Firefox, with Webshield off I get these numbers:

Last Result:
Download Speed: 13406 kbps (1675.8 KB/sec transfer rate)
Upload Speed: 2117 kbps (264.6 KB/sec transfer rate)

Last Result:
Download Speed: 12959 kbps (1619.9 KB/sec transfer rate)
Upload Speed: 4403 kbps (550.4 KB/sec transfer rate)

Last Result:
Download Speed: 12925 kbps (1615.6 KB/sec transfer rate)
Upload Speed: 4432 kbps (554 KB/sec transfer rate)[/size]


With Firefox, with Webshield ON I get these numbers:


Last Result:
Download Speed: 6502 kbps (812.8 KB/sec transfer rate)
Upload Speed: 3400 kbps (425 KB/sec transfer rate)


Last Result:
Download Speed: 9764 kbps (1220.5 KB/sec transfer rate)
Upload Speed: 2892 kbps (361.5 KB/sec transfer rate)


Last Result:
Download Speed: 7246 kbps (905.8 KB/sec transfer rate)
Upload Speed: 2149 kbps (268.6 KB/sec transfer rate)


>>>>>>>>>>>>>>>>>>>>>>>>>>


In Internet Explorer, with WEBSHIELD Off:

Last Result:
Download Speed: 20521 kbps (2565.1 KB/sec transfer rate)
Upload Speed: 3398 kbps (424.8 KB/sec transfer rate)

Last Result:
Download Speed: 19346 kbps (2418.3 KB/sec transfer rate)
Upload Speed: 3932 kbps (491.5 KB/sec transfer rate)

Download Speed: 19265 kbps (2408.1 KB/sec transfer rate)
Upload Speed: 2063 kbps (257.9 KB/sec transfer rate)



In Internet Explorer, with WEBSHIELD ON:

Last Result:
Download Speed: 8880 kbps (1110 KB/sec transfer rate)
Upload Speed: 2570 kbps (321.3 KB/sec transfer rate)

Last Result:
Download Speed: 10714 kbps (1339.3 KB/sec transfer rate)
Upload Speed: 2085 kbps (260.6 KB/sec transfer rate)

Last Result:
Download Speed: 8843 kbps (1105.4 KB/sec transfer rate)
Upload Speed: 3496 kbps (437 KB/sec transfer rate)





If I filter on your suggestions of "HTML,HTM,EXE,COM,ZIP,PDF,TXT" in Webshield I get better speed results (on downloads at least, but uploads are still crippled) but I'm wondering if you filter out those extensions aren't you practically disabling Webshield from doing anything most of anything it needs to do, and if doing that why not just turn it off completely??




IF FILTERING ON "HTML,HTM,EXE,COM,ZIP,PDF,TXT" in IN FIREFOX, with WEBSHIELD ON:


Last Result:
Download Speed: 16004 kbps (2000.5 KB/sec transfer rate)
Upload Speed: 1542 kbps (192.8 KB/sec transfer rate)

Last Result:
Download Speed: 16498 kbps (2062.3 KB/sec transfer rate)
Upload Speed: 1280 kbps (160 KB/sec transfer rate)

Last Result:
Download Speed: 13023 kbps (1627.9 KB/sec transfer rate)
Upload Speed: 2259 kbps (282.4 KB/sec transfer rate)


>>>>>>>>>>

IF FILTERING ON "HTML,HTM,EXE,COM,ZIP,PDF,TXT" in IN IE, with WEBSHIELD ON:

Last Result:
Download Speed: 15775 kbps (1971.9 KB/sec transfer rate)
Upload Speed: 1358 kbps (169.8 KB/sec transfer rate)

Last Result:
Download Speed: 16572 kbps (2071.5 KB/sec transfer rate)
Upload Speed: 2225 kbps (278.1 KB/sec transfer rate)

Last Result:
Download Speed: 11552 kbps (1444 KB/sec transfer rate)
Upload Speed: 1764 kbps (220.5 KB/sec transfer rate)




As a sanity check, testing again in IE with Webshield completely disabled I get:

Last Result:
Download Speed: 18081 kbps (2260.1 KB/sec transfer rate)
Upload Speed: 3543 kbps (442.9 KB/sec transfer rate)



Again, I think there is something strange with this desktop PC and the way Webshield is working now.  I never used to see this extreme amount of slowdown with it and this particular bandwidth test (which is what the accepted "gold standard" is for testing 'round here where I live, which still shows what are to be expected #s when Webshield isn't running).     

What resources does Webshield use on a PC, how can I see that??   I am suspecting my PC is swapping out to disc with it or something? Again, it looks fine on my laptop with 3gb ram & a faster processor.   Thanks again for any comments.

[Sammo]

Why TXT

Because of stuff like this:
http://www.eicar.org/download/eicar.com.txt

[Sammo]

You may want to start by filtering these (Web Shield - Customize - Web Scanning): HTML,HTM,EXE,COM,ZIP,PDF,TXT

As for the proxy settings, if you are using Firefox: Options - Advanced - Network - Settings (see attached graphic).

Thanks but - Can you please explain what those proxy settings are doing/what they mean??

Make sure that you have Web Shield enabled if you are using the proxy settings.

[elzar]

You may want to start by filtering these (Web Shield - Customize - Web Scanning): HTML,HTM,EXE,COM,ZIP,PDF,TXT

As for the proxy settings, if you are using Firefox: Options - Advanced - Network - Settings (see attached graphic).

Thanks but - Can you please explain what those proxy settings are doing/what they mean??

Make sure that you have Web Shield enabled if you are using the proxy settings.

Ok, tried that and now Firefox works.   I had made the proxy change with Webshield off so I could do the baseline Webshield OFF testing first then do the Webshield ON testing as comparison, but found the browser unable to connect to anything.

Now I think I understand it though - correct me if I'm wrong.  That must mean that the proxy in this case is Webshield itself, or that is, the port that it uses - it must redirect all web traffic through that port.  So by configuring that port as a proxy you are having the browser (Firefox) redirect all it's internet traffic to that port, thereby theoretically reducing some possible overhead that Webshield would normally be doing redirecting the traffic to "12080" during its scan - is that right?


Anyways, testing that now, I'm still getting the horribly impacted network speeds, so setting the proxy directly instead of letting webshield do its redirection thing doesn't help my situation :-(


Test now with Firefox proxy changed and webshield on:

Last Result:
Download Speed: 6735 kbps (841.9 KB/sec transfer rate)
Upload Speed: 3490 kbps (436.3 KB/sec transfer rate)



Test now with Firefox no proxy defined and webshield off:

Last Result:
Download Speed: 13366 kbps (1670.8 KB/sec transfer rate)
Upload Speed: 4561 kbps (570.1 KB/sec transfer rate)



Thanks for that idea though, because if enabling that proxy did actually make a difference I would've then wanted to know how to set it up in IE and Seamonkey and mystery would've been solved.   But it doesn't work, I'm still getting speeds majorly impacted....rats!

[lukor]

From you measurements I have found out, that for Firefox, using WebShield with the suggested exceptions actually increases your download speeds --- and this is interresting allthough somewhat hard to believe.