Considerations when investigating slow Web Browsing

This article applies to:

• WebMarshal 6.X and 7.X

Question:

• What should I consider when my WebMarshal installation is running slower than normal?
• What factors can affect browsing and operational performance?

Items To Consider:

•  Is browsing really slower, or does it just seem slower?
  • Time a page from click to complete.
  • The images may seem to 'pop in' rather than displaying partially as they load, which can make the page loading seem slower. However, the total time taken to load the page is roughly the same.

Hardware and Server Specification

• Does the WebMarshal server meet (or exceed) the recommended hardware requirements?
  • If you are using a virtual machine, does the host have adequate resources to support all VMs?
• Does the WebMarshal server have two NICs? If so are they listed in the correct order?
  • On the WebMarshal server, navigate to Network Connections --> Advanced --> Advanced Settings --> Adapters and Bindings. Ensure the Local/Inside network is first in the list.

Client Configuration

• Toggle use of HTTP 1.1 in the end-user's browser settings (normally 1.1 will give better performance)
  • Internet Explorer: Tools --> Internet Options --> Advanced
    • Setting: Use HTTP 1.1
    • Setting: Use HTTP 1.1 through proxy connections
  • Firefox: In the Address Bar enter about:config 
    • Filter for network.http
    • Setting: network.http.version
    • Setting: network.http.proxy.version
• Is the speed impacted in only one browser or workstation?
  • Is the speed acceptable in another browser?
  • Are plugins enabled on the slow browser?
  • Are "performance enhancers" loaded for the browser?
• Do the end-users have web filtering applications installed locally such as an antivirus application?

Firewalls

• Is there a firewall in place?
  • Is the firewall inspecting Content/Packets?
  • Are firewall resources running high?
  • Is the firewall setting "Enforce Host Tag search for CFS" enabled? If so this should be disabled.

Server Configuration

• What version of WebMarshal are you running?
  • Trustwave always recommends you use the latest version. Almost every release includes changes that can improve the browsing experience.
  • If using a version below 6.5.6, check the trickle transfer rate setting (Server & Array Settings > Download Options). This setting can safely be increased to 90%.
  • Sometimes page completion can be slower for large pages with a lot of text. WebMarshal returns the entire page to the browser after scanning, which means that the browser doesn’t get the opportunity to begin loading satellite resources while continuing to receive the page. From WebMarshal version 6.5, you can configure the holdback for text and binary files separately (Server & Array Settings > Download Options).
• Is WebMarshal configured to use caching?
  • Caching can help to reduce delays in fetching pages. Ensure that the cache folder is on a high quality disk with adequate free space.
  • Note that WebMarshal does not cache the result of rule evaluation. Rules are re-run for every request.
• Is WebMarshal configured to use an upstream proxy?
  • If users access the web via the upstream proxy (bypassing WebMarshal), is there a change in performance?
  • Does setting WebMarshal to access the web directly instead of via an upstream proxy increase the performance?
• Consider disabling Reverse DNS lookups for client workstations: 
  • See Q11895 
• Does the timeout threshold need to be increased? (The current default setting is 300 seconds.) 
  • See Q12914 
• Has Advanced Logging been left on at some stage causing reduced performance due to the extra load?
• Ensure that NetBIOS over TCP is enabled on the WebMarshal servers.

Rules and Processing Settings

• Does disabling rule processing (the Access Policy) inside WebMarshal improve the performance?
• Are complex or multiple text censor scripts being applied for many result pages?
• Is URLCensor installed and enabled with WebMarshal?
  • This feature depends on DNS lookups and can be slow to respond in a real-time environment. You should consider disabling it.
• Are there large URL Categories? If so, these will slow down each request as the list is scanned.
• Is HTTPS Content inspection enabled? This will increase the engine load and reduce performance.
• If WebMarshal is configured to use virus scanners, is performance increased after disabling them?
  • Are  the "Extensive Virus Scanning" rules enabled?
  • Is the Virus Scanner slow to respond?
  • Is more than one scanner installed and enabled via the rule set? If so this will cause duplicate scanning to occur on every web request.