Decrease in TCP network throughput observed when some McAfee products are installed

Technical Articles ID: KB89750
Last Modified: 1/9/2020

Environment

McAfee Endpoint Security (ENS) - all supported versions
McAfee Host Intrusion Prevention (Host IPS) - all supported versions
McAfee VirusScan Enterprise (VSE) - all supported versions

Summary

Multiple tools are available to measure network throughputs at various layers; some are closer to the hardware, and some are further away from the hardware.

Examples of available measurement tools:

Windows Event Tracing
NTttcp
Wireshark

With the functionality included in ENS, Host IPS, and VSE, it is possible to effectively perform deep analysis of network packets. This analysis can discover malicious behavior and threats that use the network vector to propagate and spread. This analysis must be done using the resources locally available on any given system, and those operations inevitably incur some overhead and consume CPU cycles.

Problem

Network throughput appears to be degraded after either installing a McAfee product or a McAfee update. As stated above, network tools can sometimes identify differences in the use of network resources between various McAfee product versions or update levels.

These differences are caused by changes in network filtering technology used by the McAfee drivers as the products move to newer versions and updates. In part, these differences can also be attributed to changes in the underlying operating system. For example, when Microsoft deprecates the Transport Driver Interface (TDI) platform and moves to Windows Filtering Platform (WFP) for a range of Microsoft operating systems, with one technology offering improvements over another.

TDI references:

Microsoft TDI links: http://msdn.microsoft.com/library/ff565094.aspx
Product Management statement relating to the use of TDI Drivers in VSE: KB70336.

Cause

In high-speed network environments, for example, networks that handle 10 GB, there is a theoretical throughput of one billion bytes per second. A modern CPU, such as Intel® i7 or similar, might be able to compute 160 billion instructions per second, depending on architecture and many other factors. There are 160 CPU instructions that can be executed for the entire operating system for every byte that comes in on a fast CPU. Given that a CPU must often wait, and must process other instructions, such as Interrupts and DPCs, it is unlikely to ever reach any given theoretical maximum. This fact is why physical Network Interface Cards (NICs) use Direct Memory Access (DMA) or Hardware (HW) resources and bypass the CPU, because the CPUs cannot process the data that the NIC can transfer.

The problem can also be compounded by virtualizing CPUs or NICs. In modern IT environments, virtualization provides many benefits. But virtualization can contribute to the network problem because it adds another layer of processing. Thus, any perceived slowness is possibly less pronounced or absent when trying to replicate a particular scenario on actual physical hardware.

For a VMware reference that covers the impact of virtual machine memory and CPU resource limits as they pertain to scheduling of physical resources to virtual resources, see
https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1033115

Solution

McAfee product development teams continuously research and develop products to improve their ability to handle faster network cards and network throughput.

Workaround

To improve throughput, enable one or both of the following on the network card:

Receive Segment Coalescing (RSC)
Receive Side Scaling (RSS)

RSC is a stateless offload technology that helps reduce CPU utilization for network processing on the receive side by offloading tasks from the CPU to an RSC-capable network adapter. By enabling RSC, it takes a load off the CPU for network processing and puts it on the RSC capable Network Interface.

RSC enables an RSC-capable network interface card to do the following:

Parse multiple TCP/IP packets and strip the headers from the packets while preserving the payload of each packet.
Join the combined payloads of the multiple packets into one packet.
Send the single packet, which contains the payload of multiple packets, to the network stack for subsequent delivery to applications.

RSS is a network driver technology that enables the efficient distribution of network receive processing across multiple CPUs in multi-processor systems.

RSS can improve network system performance by reducing:

Processing delays by distributing receive processing from a NIC across multiple CPUs.
Spin lock overhead by increasing the probability that software algorithms that share data execute on the same CPU.
Reloading of caches and other resources by increasing the probability that software algorithms that share data execute on the same CPU.

When configuring RSS in the properties section of the installed virtual NIC set Receive Side Scaling to Enabled. Also, check the values set for Maximum Numbers of RSS Queues and Maximum Numbers of RSS Processors. It is recommended that these values be set in line with the number of installed logical CPU cores. The number of available processors might depend on the installed operating system, in other words, a Workstation or Server operating system.

NOTE: Having Maximum Numbers of RSS Queues and Maximum Numbers of RSS Processors not configured or set to 0 effectively disables RSS, despite having Receive Side Scaling set to Enabled. All three need to be set.

References:

Receive Segment Coalescing (RSC): https://technet.microsoft.com/en-us/library/hh997024.aspx
Introduction to Receive Side Scaling (RSS): https://docs.microsoft.com/en-us/windows-hardware/drivers/network/introduction-to-receive-side-scaling

Affected Products

Endpoint Security Firewall 10.6.x
Endpoint Security Firewall 10.5.x
Endpoint Security for Linux Firewall 10.6.x
Endpoint Security for Linux Threat Prevention 10.x
Endpoint Security for Mac Firewall 10.x
Endpoint Security for Mac Threat Prevention 10.x
Endpoint Security for Mac Web Control 10.x
Endpoint Security Threat Prevention
Endpoint Security Threat Prevention 10.6.x
Endpoint Security Threat Prevention 10.5.x
Endpoint Security Web Control 10.6.x
Endpoint Security Web Control 10.5.x
Host Intrusion Prevention 8.0
VirusScan Enterprise 8.8

Languages:

This article is available in the following languages:

English United States
Spanish Spain
French
Japanese
Portuguese Brasileiro
Chinese Simplified

Glossary of Technical Terms

Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.

Decrease in TCP network throughput observed when some McAfee products are installed

Environment

Summary

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Title

Title

Featured Solutions:Draft for New Nav

Explore Our Portfolio

Security Outcomes

Industries

Products

Featured Solutions

Explore Our Portfolio

MVISION Products

Services & Training

Threat Research

Our Researchers

Threat Landscape Dashboard

Tools

Contact Us

Resources

Downloads

Product Help

Connect with Us

Explore

Our Company

Our Efforts

Other Resources

Careers

Partnerships

Decrease in TCP network throughput observed when some McAfee products are installed

Environment

Summary

Problem

Cause

Solution

Workaround

Affected Products

Languages:

Glossary of Technical Terms

Choose your region

Title

Title