Optimization #2302: rule parsing: faster parsing by not using pcre - Suricata - Open Information Security Foundation

Actions

Copy link

Optimization #2302

closed

rule parsing: faster parsing by not using pcre

Added by Jason Ish about 7 years ago. Updated about 7 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

4.1beta1

Effort:

Difficulty:

Label:

Description

Regular expressions are generally not the best idea for parsers. But moving away from regexp's to tokenizing the strings we should be able to provide more context around a parse error in the rule, as well as speed up rule parsing. Initial tests showed a 2x speed up on modern Intel CPUs, and 5x or more on older Intel CPUs.