Project

General

Profile

Actions

Bug #6414

open

detect-engine/port: recursive DetectPortInsert calls are expensive

Added by Shivani Bhardwaj 7 months ago. Updated 3 months ago.

Status:
Resolved
Priority:
High
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Problem
It seems that for certain kinds of rules, the recursive calls to DetectPortInsert can be very expensive.
There has been a todo to get rid of the recursive calls since a long time that needs to be addressed now.
The issue can be observed for large rulesets especially containing a mix of drop tls rules and others.
One noteworthy thing is that these rules loaded separately end up consuming much lesser time.

Useful info
Attached is one scenario where the flamegraph shows heavy frequenting of this fn.


Files

perf.svg (679 KB) perf.svg Shivani Bhardwaj, 10/19/2023 03:57 PM

Subtasks 3 (1 open2 closed)

Bug #6431: detect-engine/port: recursive DetectPortInsert calls are expensive (6.0.x backport)RejectedShivani BhardwajActions
Bug #6520: detect-engine/port: recursive DetectPortInsert calls are expensive (7.0.x backport)In ReviewShivani BhardwajActions
Bug #6639: detect-engine/port: recursive DetectPortInsert calls are expensive (7.0.x backport)RejectedShivani BhardwajActions

Related issues 2 (2 open0 closed)

Related to Suricata - Optimization #6795: detect/port: PortGroupWhitelist fn takes a lot of processing timeResolvedVictor JulienActions
Related to Suricata - Optimization #6792: detect/port: port grouping is quite slow in worst casesResolvedShivani BhardwajActions
Actions #1

Updated by Shivani Bhardwaj 7 months ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
  • Target version changed from TBD to 7.0.3
Actions #2

Updated by OISF Ticketbot 7 months ago

  • Subtask #6431 added
Actions #3

Updated by OISF Ticketbot 7 months ago

  • Label deleted (Needs backport to 6.0)
Actions #4

Updated by Victor Julien 6 months ago

  • Target version changed from 7.0.3 to 8.0.0-beta1
  • Label Needs backport to 7.0 added
Actions #5

Updated by OISF Ticketbot 6 months ago

  • Subtask #6520 added
Actions #6

Updated by OISF Ticketbot 6 months ago

  • Label deleted (Needs backport to 7.0)
Actions #7

Updated by Shivani Bhardwaj 5 months ago

  • Label Needs backport to 7.0 added
Actions #8

Updated by OISF Ticketbot 5 months ago

  • Subtask #6639 added
Actions #9

Updated by OISF Ticketbot 5 months ago

  • Label deleted (Needs backport to 7.0)
Actions #10

Updated by Shivani Bhardwaj 5 months ago

  • Label Needs backport to 7.0 added
Actions #11

Updated by OISF Ticketbot 5 months ago

  • Label deleted (Needs backport to 7.0)
Actions #12

Updated by Shivani Bhardwaj 3 months ago

  • Related to Optimization #6795: detect/port: PortGroupWhitelist fn takes a lot of processing time added
  • Related to Optimization #6792: detect/port: port grouping is quite slow in worst cases added
Actions #13

Updated by Shivani Bhardwaj 3 months ago

  • Status changed from Assigned to In Review
Actions #14

Updated by Shivani Bhardwaj 3 months ago

  • Status changed from In Review to Resolved
Actions

Also available in: Atom PDF