Project

General

Custom queries

Profile

Actions

Bug #6291

closed

Performance degradation on Suricata devices with a small number of rules

Added by Cole Dishington over 1 year ago. Updated 6 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
C

Description

Devices running a small number of rules, none of which being MPM-based rules, experienced a performance degradation of ~4%-16% throughput between Suricata 4 and Suricata 5 releases. The performance degradation is present in all releases past Suricata 5. The performance degradation was traced to:

0965afd66 detect: pkt inspect engines

The linked commit modified the default pkt inspection engines to be called through a function pointer. Previously, the default packet inspection errors were inlined.


Related issues 3 (0 open3 closed)

Related to Suricata - Optimization #6728: detect: prefilter for events (decode, stream, app-layer, etc...)ClosedPhilippe AntoineActions
Related to Suricata - Optimization #7002: detect: move pseudo packet checks out of keyword Match funcsClosedVictor JulienActions
Related to Suricata - Bug #7106: packet: app-layer-events incorrectly used on recycled packetsClosedPhilippe AntoineActions
Actions #1

Updated by Peter Manev over 1 year ago

Can you share some steps or details how to reproduce the performance degradation issue please?

How many rules/what type/what type of traffic/any specific run commands or config options enabled if relevant etc.
Thanks

Actions #2

Updated by Cole Dishington over 1 year ago

Peter Manev wrote in #note-1:

Can you share some steps or details how to reproduce the performance degradation issue please?

How many rules/what type/what type of traffic/any specific run commands or config options enabled if relevant etc.
Thanks

I experienced the performance degradation when updating from Suricata 4.0.6 to Suricata 7.0.0, this performance degradation was noticed on a setup with the following:
  • 176 signatures
  • 3 are inspecting packet payload
  • 33 inspect application layer
  • 83 are decoder event only

The performance test used UDP, entirely traffic that would be detected as non-malicious, and Suricata running in IPS mode.

This performance impact was significant when running a small number of lightweight rules, but was not significant on larger (and more heavy-duty) rule sets. I have submitted a pull request (https://github.com/OISF/suricata/pull/9429) that changes the default packet inspection engines to inline, like they were in Suricata 4 before extra packet inspection engines were supported.

Thanks

Actions #3

Updated by Victor Julien over 1 year ago

  • Target version changed from 7.0.1 to 7.0.2
Actions #4

Updated by Victor Julien about 1 year ago

  • Target version changed from 7.0.2 to 7.0.3
Actions #5

Updated by Victor Julien about 1 year ago

  • Target version changed from 7.0.3 to 8.0.0-beta1
Actions #7

Updated by Cole Dishington 11 months ago

  • Status changed from New to In Review
Actions #8

Updated by Philippe Antoine 6 months ago

  • Related to Optimization #6728: detect: prefilter for events (decode, stream, app-layer, etc...) added
Actions #9

Updated by Philippe Antoine 6 months ago

  • Related to Optimization #7002: detect: move pseudo packet checks out of keyword Match funcs added
Actions #10

Updated by Philippe Antoine 6 months ago

  • Related to Bug #7106: packet: app-layer-events incorrectly used on recycled packets added
Actions #11

Updated by Philippe Antoine 6 months ago

@Cole Dishington could you tell if you still have the problem with latest master after merge of https://github.com/OISF/suricata/pull/11337 ?

Actions #12

Updated by Cole Dishington 6 months ago

  • Status changed from In Review to Closed

@Philippe Antoine I haven't yet been able to get the latest Suricata compiling with my toolchain (due to mismatch of archs in the lua .o files). I will re-test when I am able to get the newer versions of Suricata working with my toolchain, until then I will close of this issue. Thanks

Actions #13

Updated by Philippe Antoine 6 months ago

Thanks Cole, you can also test with suricata-7.0.6

Actions

Also available in: Atom PDF