Suricata

With Suricata 5.0.x, perf shows excessive time spent in IPOnlyMatchPacket when there are rules containing IP addresses as filters. With roughly 400 rules and 15-20K IP addresses, perf showed a majority of time spent in IPOnlyMatchPacket.

Granted, a dataset is a better way to handle large IP address counts used within a rule but 5.0.x support didn't contain official dataset support.

Perhaps a warning or other indicator could be displayed to help users understand the effects of rules with large IP addr counts?