Project

General

Profile

Actions
Copy link

Bug #4578

closed
JL JA

perf shows excessive time in IPOnlyMatchPacket

Bug #4578: perf shows excessive time in IPOnlyMatchPacket

Added by Jeff Lucovsky over 4 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Justin Azoff
Target version:
7.0.0-rc2
Affected Versions:
5.0.3
Effort:
Difficulty:
Label:

Description

With Suricata 5.0.x, perf shows excessive time spent in IPOnlyMatchPacket when there are rules containing IP addresses as filters. With roughly 400 rules and 15-20K IP addresses, perf showed a majority of time spent in IPOnlyMatchPacket.

Granted, a dataset is a better way to handle large IP address counts used within a rule but 5.0.x support didn't contain official dataset support.

Perhaps a warning or other indicator could be displayed to help users understand the effects of rules with large IP addr counts?

Files

iponlymatchpacketdiff.png (83.4 KB) iponlymatchpacketdiff.png Andreas Herz, 05/10/2023 01:13 PM

Subtasks 2 (0 open — 2 closed)

Bug #5997: perf shows excessive time in IPOnlyMatchPacket (6.0.x backport)ClosedJeff LucovskyActions
Bug #6005: perf shows excessive time in IPOnlyMatchPacket (6.0.x backport)RejectedJustin AzoffActions

JL Updated by Jeff Lucovsky about 3 years ago Actions
Copy link
 #1

  • Status changed from New to In Review

VJ Updated by Victor Julien about 3 years ago Actions
Copy link
 #2

  • Assignee set to Justin Azoff
  • Target version set to 7.0.0-rc2

VJ Updated by Victor Julien almost 3 years ago Actions
Copy link
 #3

  • Status changed from In Review to Closed
  • Label Needs backport to 6.0 added

VJ Updated by Victor Julien almost 3 years ago Actions
Copy link
 #4

  • Status changed from Closed to Resolved

OT Updated by OISF Ticketbot almost 3 years ago Actions
Copy link
 #5

  • Subtask #5997 added

OT Updated by OISF Ticketbot almost 3 years ago Actions
Copy link
 #6

  • Label deleted (Needs backport to 6.0)

JL Updated by Jeff Lucovsky almost 3 years ago Actions
Copy link
 #7

  • Label Needs backport to 6.0 added

OT Updated by OISF Ticketbot almost 3 years ago Actions
Copy link
 #8

  • Subtask #6005 added

OT Updated by OISF Ticketbot almost 3 years ago Actions
Copy link
 #9

  • Label deleted (Needs backport to 6.0)

VJ Updated by Victor Julien almost 3 years ago Actions
Copy link
 #10

  • Status changed from Resolved to Closed

AH Updated by Andreas Herz almost 3 years ago Actions
Copy link
 #11


Added a perf top output to see the impact of the patch

Actions
Copy link

Also available in: PDF Atom