Project

General

Profile

Actions

Bug #1770

open

Suricata takes very long time to start using hyperscan and large/custom detect settings

Added by Peter Manev over 8 years ago. Updated about 5 years ago.

Status:
Feedback
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using 3.1dev (rev b92a08b) with the following settings -

detect:
  profile: custom
  custom-values:
    toclient-groups: 600
    toserver-groups: 800
  sgh-mpm-context: full

and

mpm-algo: hs

it takes very long time for Suricata to start as opposed to using the same settings but with
mpm-algo: ac-ks

  profile: low/medium/high

are working fine though.
Actions

Also available in: Atom PDF