Project

General

Profile

Actions
Copy link

Optimization #5134

open

DCERPC: dcerpc.iface keyword not using fast pattern/mpm causes severe performance degradation

Added by Peter Manev over 3 years ago. Updated about 2 months ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:

Description

Please see attached for full comparison between 5.0.8 / 6.0.4 and master
The pcap used - https://redmine.openinfosecfoundation.org/attachments/2434

Files

dcerpc-perf-accuracy.txt (7.6 KB) dcerpc-perf-accuracy.txt Peter Manev, 02/19/2022 02:50 PM
Actions
Copy link
 #1

Updated by Lukas Sismis over 1 year ago

Requires custom DCERPC Prefilter because the field is not content and supports masking and different operators.

Actions
Copy link
 #2

Updated by Philippe Antoine about 2 months ago

  • Tracker changed from Bug to Optimization
  • Affected Versions deleted (5.0.8, 6.0.4, git main)
Actions
Copy link

Also available in: Atom PDF