Project

General

Profile

Actions

Optimization #6792

closed

detect/port: port grouping is quite slow in worst cases

Added by Shivani Bhardwaj 10 months ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Given how the port grouping was done historically, in some worst case scenarios, it could take a very long time to group the signatures on the basis of ports and thus increasing the entire time taken by the engine to start by a huge factor.


Subtasks 3 (0 open3 closed)

Optimization #6795: detect/port: PortGroupWhitelist fn takes a lot of processing timeClosedVictor JulienActions
Optimization #6829: detect/port: PortGroupWhitelist fn takes a lot of processing time (7.0.x backport)ClosedShivani BhardwajActions
Optimization #6830: detect/port: port grouping is quite slow in worst cases (7.0.x backport)ClosedShivani BhardwajActions

Related issues 5 (0 open5 closed)

Related to Suricata - Bug #6414: detect-engine/port: recursive DetectPortInsert calls are expensiveClosedShivani BhardwajActions
Related to Suricata - Bug #6843: detect/port: port ranges are incorrect when a port is single as well as a part of rangeClosedShivani BhardwajActions
Related to Suricata - Bug #6881: detect/port: port grouping does not happen correctly if gap between a single and range portClosedShivani BhardwajActions
Related to Suricata - Bug #6896: detect/port: upper boundary ports are not correctly handledClosedShivani BhardwajActions
Related to Suricata - Bug #2908: ip only rules cause suricata to take 17 minutes to startClosedActions
Actions #1

Updated by Shivani Bhardwaj 10 months ago

  • Status changed from Assigned to In Review
Actions #2

Updated by Shivani Bhardwaj 10 months ago

  • Subtask #6795 added
Actions #3

Updated by Shivani Bhardwaj 9 months ago

  • Related to Bug #6414: detect-engine/port: recursive DetectPortInsert calls are expensive added
Actions #4

Updated by Shivani Bhardwaj 9 months ago

  • Status changed from In Review to Resolved
Actions #5

Updated by Shivani Bhardwaj 9 months ago

  • Label Needs backport to 7.0 added
Actions #6

Updated by OISF Ticketbot 9 months ago

  • Subtask #6830 added
Actions #7

Updated by OISF Ticketbot 9 months ago

  • Label deleted (Needs backport to 7.0)
Actions #8

Updated by Shivani Bhardwaj 9 months ago

  • Related to Bug #6843: detect/port: port ranges are incorrect when a port is single as well as a part of range added
Actions #9

Updated by Shivani Bhardwaj 9 months ago

  • Related to Bug #6881: detect/port: port grouping does not happen correctly if gap between a single and range port added
Actions #10

Updated by Shivani Bhardwaj 9 months ago

  • Related to Bug #6896: detect/port: upper boundary ports are not correctly handled added
Actions #11

Updated by Victor Julien 8 months ago

  • Related to Bug #2908: ip only rules cause suricata to take 17 minutes to start added
Actions #12

Updated by Shivani Bhardwaj 7 months ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF