Bug #6291
open
Performance degradation on Suricata devices with a small number of rules
Added by Cole Dishington 9 months ago.
Updated 4 months ago.
Description
Devices running a small number of rules, none of which being MPM-based rules, experienced a performance degradation of ~4%-16% throughput between Suricata 4 and Suricata 5 releases. The performance degradation is present in all releases past Suricata 5. The performance degradation was traced to:
0965afd66 detect: pkt inspect engines
The linked commit modified the default pkt inspection engines to be called through a function pointer. Previously, the default packet inspection errors were inlined.
Can you share some steps or details how to reproduce the performance degradation issue please?
How many rules/what type/what type of traffic/any specific run commands or config options enabled if relevant etc.
Thanks
Peter Manev wrote in #note-1:
Can you share some steps or details how to reproduce the performance degradation issue please?
How many rules/what type/what type of traffic/any specific run commands or config options enabled if relevant etc.
Thanks
I experienced the performance degradation when updating from Suricata 4.0.6 to Suricata 7.0.0, this performance degradation was noticed on a setup with the following:
- 176 signatures
- 3 are inspecting packet payload
- 33 inspect application layer
- 83 are decoder event only
The performance test used UDP, entirely traffic that would be detected as non-malicious, and Suricata running in IPS mode.
This performance impact was significant when running a small number of lightweight rules, but was not significant on larger (and more heavy-duty) rule sets. I have submitted a pull request (https://github.com/OISF/suricata/pull/9429) that changes the default packet inspection engines to inline, like they were in Suricata 4 before extra packet inspection engines were supported.
Thanks
- Target version changed from 7.0.1 to 7.0.2
- Target version changed from 7.0.2 to 7.0.3
- Target version changed from 7.0.3 to 8.0.0-beta1
- Status changed from New to In Review
Also available in: Atom
PDF