Sourcefire Network Exclusion

[allensurface]

Can you exclude network traffic from being processed by the sensor so that it doesn't impact the load on the appliance? For example, if you have an 5G appliance with 10G ports inline with a network and you want to only process certain traffic. Can you have10Gig of traffic with 5Gigs of unmonitored traffic go through the box and not have it impact the performance? 

[Marvin Rhoads]

Put the networks you don't want to inspect into a "trusted" object and set your access control policy to trust traffic from it. That will keep the sensor from inspecting that traffic.

We do this, for instance, with high volume backup traffic that transits the IPS en route to an off-site backup or replication destination.