Suricata

The "ac-bs" implementation is slower than the other implementations we support by a wide margin, so there is no reason to keep it around.

Xeon E5-2680v4

profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141              945        4361238         61719         24.8b  43.38 
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401139              939         582339         25620         10.3b  38.00 
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401142              951        4730010         24033          9.6b  36.30 
profile-mpm-sandnet.pcap-open.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401144              939       35647355         12850          5.2b  28.97 
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141              948       21126890         78408         31.5b  43.38 
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401140              987        1286478         34830         14.0b  38.87 
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401142              960        5074068         32013         12.8b  37.64 
profile-mpm-sandnet.pcap-pro.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401146              951        3292209         20061          8.0b  32.97

AMD Threadripper 2990wx

profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401143             1350        2435370         68706         27.6b  42.15 
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401142             1350        2987040         25232         10.1b  33.12 
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401140             1350        2496660         25391         10.2b  32.75 
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401142             1350        2769840         91025         36.5b  40.58 
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401142             1350        2841630         40201         16.1b  34.34 
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401145             1350        2922510         39870         16.0b  33.18 

Rock 5b (arm64), unit is usecs instead of ticks, "hs" is vectorscan

profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        399952                1           1315            39         15.6m  43.67 
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        395419                1           1191            16          6.5m  37.97 
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        395102                1            930            19          7.7m  38.22 
profile-mpm-sandnet.pcap-open.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        400215                1            291             9          3.7m  31.62 
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        400172                1            961            51         20.7m  44.57 
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        397677                1           1218            25         10.0m  39.80 
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        397701                1            832            26         10.7m  39.65 
profile-mpm-sandnet.pcap-pro.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        400688                1            807            15          6.1m  35.44 

Xeon W-2245

profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401143             1119        1380242         82818         33.2b  41.96 
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141             1042         753077         29483         11.8b  34.39 
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401142             1095         582962         27795         11.2b  33.38 
profile-mpm-sandnet.pcap-open.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141             1259         334663         14925          6.0b  26.08 
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141             1089        2042454        107378         43.1b  41.52 
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401145             1105        2740803         42612         17.1b  35.16 
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141             1081        1226400         38685         15.5b  33.38 
profile-mpm-sandnet.pcap-pro.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401139             1267        2384529         24090          9.7b  29.04

Odroid HC1 (arm7), unit is usecs instead of ticks

profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141               16            975            80         32.4m  18.13 
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141               16            885            54         21.8m  15.68 
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401142               16           2935            53         21.5m  15.75 
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401141               16           1770           106         42.7m  18.45 
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401143               16           1912            68         27.6m  16.12 
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD      IPv4       6        401139               16           1456            67         27.2m  16.18 

In all tested cases and hw setups "ac-bs" is far slower than regular "ac", often by a wide margin.

Output generated with https://github.com/victorjulien/suricata/blob/experiment-ac-rust/v7/benches/profile-mpm.sh