> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/intrusion-detection-system-ids/how-can-i-prevent-performance-issues-with-the-enginsight-ids-on-windows-systems.md).

# How can I prevent performance issues with the Enginsight IDS on Windows systems?

With the Enginsight Intrusion Detection System (IDS), you can monitor network traffic on all hosts where the Enginsight agent Pulsar is installed to detect attacks, misuse, and violations of security policies.

However, in networks with high traffic volumes over individual ports, an enabled IDS can cause performance issues. To avoid load spikes, you can specifically filter the traffic that should be monitored.

In the following, we will show you how to set filter rules on Windows systems that have the Pulsar agent installed.

***

## Targeted Port and Subnet Filtering

To reduce the load on the IDS that is caused by data-intensive ports, you can explicitly exclude those ports. This is particularly useful if, for example, backup systems, update servers, or management tools regularly transfer large amounts of data. You can also restrict IDS monitoring to selected IP address ranges.

{% hint style="info" %}
Starting with Pulsar version 6.4.17, the `-windivert-filter` flag is available for this purpose. It allows you to define custom filter rules in WinDivert syntax so that you can control the IDS data stream as needed.
{% endhint %}

Custom filter rules can be set as follows:

{% stepper %}
{% step %}

### Stop services

Log in to the Windows host whose ports you want to exclude or on which you want to restrict the monitored subnet.

Stop the Pulsar agent and the Supervisor service via the Windows Services app `services.msc` or the Task Manager.
{% endstep %}

{% step %}

### Configure filter rules

You can configure a filter rule in Windows CMD using the Service Controller tool `sc.exe`, or in PowerShell.

{% hint style="warning" %}
**Please note**: This action changes the Pulsar agent's `binPath` configuration.
{% endhint %}

In the following, you will find example filter rules for excluding a port and a subnet, each once using `sc.exe` and once using PowerShell:

#### Example: Excluding the WSUS ports 5380 and 5381

**Exclusion using `sc.exe`**

```
sc.exe config "Enginsight Pulsar" binpath= "C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter 'localPort != 5380 and localPort != 5381'"
```

{% hint style="danger" %}
**Please note**: The entire filter expression, here `'localPort != 5380 and localPort != 5381'`, must be enclosed in **single quotation marks**. Otherwise, only the first word will be interpreted, which leads to incorrect behavior. The entire **binPath**, here `"C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter 'localPort != 5380 and localPort != 5381'"`, must be enclosed in **double quotation marks**.
{% endhint %}

**Exclusion using PowerShell**

```
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Enginsight Pulsar\' -Name ImagePath -Value 'C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter "localPort != 5380 and localPort != 5381"'
```

{% hint style="danger" %}
**Please note**: The entire **filter expression**, here `"localPort != 5380 and localPort != 5381"`, must be enclosed in **double quotation marks**. The entire **value**, here `'C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter "localPort != 5380 and localPort != 5381"'`, must be enclosed in **single quotation marks**.
{% endhint %}

#### Example: Excluding the subnet 10.0.0.0/24

**Exclusion using `sc.exe`**

```
sc.exe config "Enginsight Pulsar" binpath= "C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter 'remoteAddr <= 10.0.0.0 or remoteAddr > 10.0.0.255'"
```

{% hint style="danger" %}
**Please note**: The entire **filter expression**, here `'remoteAddr <= 10.0.0.0 or remoteAddr > 10.0.0.255'`, must be enclosed in **single quotation marks**. Otherwise, only the first word will be interpreted, which leads to incorrect behavior. The entire **binPath**, here `"C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter 'remoteAddr <= 10.0.0.0 or remoteAddr > 10.0.0.255'"`, must be enclosed in **double quotation marks**.
{% endhint %}

**Exclusion using PowerShell**

```
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Enginsight Pulsar\' -Name ImagePath -Value 'C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter "remoteAddr < 10.0.0.0 or remoteAddr > 10.0.0.255"' 
```

{% hint style="danger" %}
**Please note**: The entire **filter expression**, here `"remoteAddr < 10.0.0.0 or remoteAddr > 10.0.0.255"`, must be enclosed in **double quotation marks**. The entire **value**, here `'C:\Program Files\Enginsight\Pulsar\ngs-pulsar-amd64.exe -windivert-filter "remoteAddr < 10.0.0.0 or remoteAddr > 10.0.0.255"'`, must be enclosed in **single quotation marks**.
{% endhint %}
{% endstep %}

{% step %}

### Restart services

After you have set all filter rules, restart the Pulsar agent and the Supervisor service via the Windows Services app `services.msc` or the Task Manager.
{% endstep %}
{% endstepper %}

***

## Additional Measures to Reduce IDS Load

In addition to targeted filtering of ports and IP address ranges, there are other ways to improve the performance of your IDS.

### Updating Pulsar to Version 6.4.12 or Higher

Starting with Pulsar version 6.4.12, extensive performance improvements for the IDS have been implemented. If you are still using an older version, we strongly recommend updating.

{% hint style="info" %}
In general, we recommend keeping all Enginsight components up to date at all times so that you benefit from performance and feature improvements as well as better security.
{% endhint %}

### Creating a Manual Rule for the IDS

You can use the Enginsight platform to create manual rules that allow you to specifically exclude subnets from IDS monitoring.

{% hint style="success" icon="lightbulb-exclamation" %}
For more information on how to create a manual rule, see the Enginsight Manual: [Addressing an Anomaly](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/intrusion-detection-system/network-anomalies#adressing-an-anomaly)
{% endhint %}

### Installing Npcap and Enable `-use-pcap`

By installing [Npcap](https://npcap.com/) and setting the `-use-pcap` flag, you use an alternative capture backend. On some systems, the Npcap driver can improve IDS performance.

We recommend using Npcap if creating manual rules for the IDS does not provide sufficient performance improvements and a WinDivert filter expression would add a higher level of complexity.

***