15600 appliance has x2 CPUs (16 cores each) so a total core count with HT of 32.
We current have the default 4 cores for SND and there is nothing to suggest these are even breaking a sweat (using some of Tim's handy advise to check things)
We have one node running one VS running FW/IPS blades only (We did have AV/ABOT turned on but this started causing perfomance issues). The concurrent connections on this is around 250K. I've allocated 12 cores to this.
attached is a screenshot of the CPU usage. Considering all of the above I would expect 4 cores max needed for this, and the total percentage utilisation to be below 20%.
Also note that the SND core utilisation is in the 10% and below section of the screenshot.
The other node is running the rest of the VS's (5 VSs) and has a throughput level of about 1.5 - 2Gbps, and CORE utilisation, however concurrent connections are lower.