Hi Radim,
Oversubscription in IPS is at Interface level or Virtual Sensor level.
Hypothetically say IPS has 6 interfaces each being a gig port.
This does not mean IPS throughput is 6 gigs, since the inspection engine may not be able to handle 6 gig at a time.
For interface level oversubscription, if you send more traffic to an interface than it can handle, then you overwhelm its interface buffers.
The packets get dropped at the interface level.
The ' FIFO errors' counter under 'show interface' will show this error.
Packets dropped because too much traffic it being sent to virtual sensor than it can handle will be seen as 'missed packet percentage' counter.
I shall check if this traffic is dropped or passed through uninspected and let you know.
The throughput of the IPS depends on the type of traffic flowing through it.
Please check the document below which explains IPS performance with some data for 4270.
http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/prod_white_paper0900aecd806e7283.html
Hope this helps.
Sid Chandrachud
Cisco TAC - Security Team
