Project

General

Profile

Actions
Copy link

Bug #4578

closed

perf shows excessive time in IPOnlyMatchPacket

Added by Jeff Lucovsky over 2 years ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Justin Azoff
Target version:
7.0.0-rc2
Affected Versions:
5.0.3
Effort:
Difficulty:
Label:

Description

With Suricata 5.0.x, perf shows excessive time spent in IPOnlyMatchPacket when there are rules containing IP addresses as filters. With roughly 400 rules and 15-20K IP addresses, perf showed a majority of time spent in IPOnlyMatchPacket.

Granted, a dataset is a better way to handle large IP address counts used within a rule but 5.0.x support didn't contain official dataset support.

Perhaps a warning or other indicator could be displayed to help users understand the effects of rules with large IP addr counts?

Files

iponlymatchpacketdiff.png (83.4 KB) iponlymatchpacketdiff.png Andreas Herz, 05/10/2023 01:13 PM

Subtasks 2 (0 open — 2 closed)

Bug #5997: perf shows excessive time in IPOnlyMatchPacket (6.0.x backport)ClosedJeff LucovskyActions
Bug #6005: perf shows excessive time in IPOnlyMatchPacket (6.0.x backport)RejectedJustin AzoffActions
Actions
Copy link
 #1

Updated by Jeff Lucovsky about 1 year ago

  • Status changed from New to In Review
Actions
Copy link
 #2

Updated by Victor Julien about 1 year ago

  • Assignee set to Justin Azoff
  • Target version set to 7.0.0-rc2
Actions
Copy link
 #3

Updated by Victor Julien about 1 year ago

  • Status changed from In Review to Closed
  • Label Needs backport to 6.0 added
Actions
Copy link
 #4

Updated by Victor Julien about 1 year ago

  • Status changed from Closed to Resolved
Actions
Copy link
 #5

Updated by OISF Ticketbot about 1 year ago

  • Subtask #5997 added
Actions
Copy link
 #6

Updated by OISF Ticketbot about 1 year ago

  • Label deleted (Needs backport to 6.0)
Actions
Copy link
 #7

Updated by Jeff Lucovsky about 1 year ago

  • Label Needs backport to 6.0 added
Actions
Copy link
 #8

Updated by OISF Ticketbot about 1 year ago

  • Subtask #6005 added
Actions
Copy link
 #9

Updated by OISF Ticketbot about 1 year ago

  • Label deleted (Needs backport to 6.0)
Actions
Copy link
 #10

Updated by Victor Julien 12 months ago

  • Status changed from Resolved to Closed
Actions
Copy link
 #11

Updated by Andreas Herz 12 months ago


Added a perf top output to see the impact of the patch

Actions
Copy link

Also available in: Atom PDF