Project

General

Profile

Actions
Copy link

Bug #6291

closed
CD

Performance degradation on Suricata devices with a small number of rules

Bug #6291: Performance degradation on Suricata devices with a small number of rules

Added by Cole Dishington over 2 years ago. Updated 12 months ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
5.0.0, 5.0.1, 5.0.2, 5.0.3, 6.0.0, 5.0.5, 6.0.1, 6.0.2, 7.0.0, 7.0.1
Effort:
Difficulty:
Label:
C

Description

Devices running a small number of rules, none of which being MPM-based rules, experienced a performance degradation of ~4%-16% throughput between Suricata 4 and Suricata 5 releases. The performance degradation is present in all releases past Suricata 5. The performance degradation was traced to:

0965afd66 detect: pkt inspect engines

The linked commit modified the default pkt inspection engines to be called through a function pointer. Previously, the default packet inspection errors were inlined.

Related issues 3 (0 open — 3 closed)

Related to Suricata - Optimization #6728: detect: prefilter for events (decode, stream, app-layer, etc...)ClosedPhilippe AntoineActions
Related to Suricata - Optimization #7002: detect: move pseudo packet checks out of keyword Match funcsClosedVictor JulienActions
Related to Suricata - Bug #7106: packet: app-layer-events incorrectly used on recycled packetsClosedPhilippe AntoineActions
Actions
Copy link

Also available in: PDF Atom