Project

General

Profile

Actions
Copy link

Bug #3771

open

Extreme performance degradation when doing IP-only rules with flow-keyword

Added by Antti Tönkyrä almost 4 years ago. Updated almost 4 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
5.0.3
Effort:
Difficulty:
Label:

Description

I did a brief test and found out an issue when doing large sets of IP-only rules.

Following IP-only rules seem to cause a problem while same rules without flow-keyword are fine.

alert ip any any -> 10.0.0.0 any (msg: "test 1"; flow: stateless; sid: 1;)
alert ip any any -> 10.0.0.1 any (msg: "test 2"; flow: stateless; sid: 2;)
alert ip any any -> 10.0.0.2 any (msg: "test 3"; flow: stateless; sid: 3;)

Below is a test run with attached pcap and rules files. I'd expect the flow.rules would perform a bit worse than plain.rules but it turns out flow.rules takes a magnitude longer.

root@telakka:/usr/local/etc/suricata/prof# time suricata -r flowtest.pcap --runmode single -S flow.rules
15/6/2020 -- 15:15:13 - <Notice> - This is Suricata version 5.0.3 RELEASE running in USER mode
15/6/2020 -- 15:15:15 - <Notice> - all 1 packet processing threads, 2 management threads initialized, engine started.
15/6/2020 -- 15:15:26 - <Notice> - Signal Received.  Stopping engine.
15/6/2020 -- 15:15:26 - <Notice> - Pcap-file module read 1 files, 2000 packets, 1709602 bytes

real    0m13.543s
user    0m13.493s
sys     0m0.075s

root@telakka:/usr/local/etc/suricata/prof# time suricata -r flowtest.pcap --runmode single -S plain.rules
15/6/2020 -- 15:15:34 - <Notice> - This is Suricata version 5.0.3 RELEASE running in USER mode
15/6/2020 -- 15:15:36 - <Notice> - all 1 packet processing threads, 2 management threads initialized, engine started.
15/6/2020 -- 15:15:36 - <Notice> - Signal Received.  Stopping engine.
15/6/2020 -- 15:15:36 - <Notice> - Pcap-file module read 1 files, 2000 packets, 1709602 bytes

real    0m1.581s
user    0m1.301s
sys     0m0.277s

I have attached relevant pcap and rule files. Extract the rules and pcap into any directory and run:

time suricata -r flowtest.pcap --runmode single -S plain.rules
time suricata -r flowtest.pcap --runmode single -S flow.rules

Files

Download all files
flow.rules (8.76 MB) flow.rules Antti Tönkyrä, 06/15/2020 03:19 PM
plain.rules (7.14 MB) plain.rules Antti Tönkyrä, 06/15/2020 03:19 PM
flowtest.pcap (1.66 MB) flowtest.pcap Antti Tönkyrä, 06/15/2020 03:30 PM
Actions
Copy link

Also available in: Atom PDF