Hi,
Thanks for positng. Actually when you are talking about traffic through the box and the performace of the IPS, you should focus on the "Inspection load". If the inspection load is too high you will start seen missed packets and overruns on the interfaces.
Chances are that maybe with low amount of traffic the CPU can be high since it handles many process and it uses a different algorithm to calculate the value.
I recommendation will be to focus on the inspection load.
Luis Silva
Luis Silva