Project

General

Profile

Actions
Copy link

Optimization #6792

open

detect/port: port grouping is quite slow in worst cases

Added by Shivani Bhardwaj 2 months ago. Updated about 2 months ago.

Status:
Resolved
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

Given how the port grouping was done historically, in some worst case scenarios, it could take a very long time to group the signatures on the basis of ports and thus increasing the entire time taken by the engine to start by a huge factor.

Subtasks 3 (3 open — 0 closed)

Optimization #6795: detect/port: PortGroupWhitelist fn takes a lot of processing timeResolvedVictor JulienActions
Optimization #6829: detect/port: PortGroupWhitelist fn takes a lot of processing time (7.0.x backport)In ReviewShivani BhardwajActions
Optimization #6830: detect/port: port grouping is quite slow in worst cases (7.0.x backport)In ReviewShivani BhardwajActions

Related issues 5 (4 open — 1 closed)

Related to Suricata - Bug #6414: detect-engine/port: recursive DetectPortInsert calls are expensiveResolvedShivani BhardwajActions
Related to Suricata - Bug #6843: detect/port: port ranges are incorrect when a port is single as well as a part of rangeResolvedShivani BhardwajActions
Related to Suricata - Bug #6881: detect/port: port grouping does not happen correctly if gap between a single and range portResolvedShivani BhardwajActions
Related to Suricata - Bug #6896: detect/port: upper boundary ports are not correctly handledResolvedShivani BhardwajActions
Related to Suricata - Bug #2908: ip only rules cause suricata to take 17 minutes to startClosedActions
Actions
Copy link
 #1

Updated by Shivani Bhardwaj 2 months ago

  • Status changed from Assigned to In Review
Actions
Copy link
 #2

Updated by Shivani Bhardwaj 2 months ago

  • Subtask #6795 added
Actions
Copy link
 #3

Updated by Shivani Bhardwaj about 2 months ago

  • Related to Bug #6414: detect-engine/port: recursive DetectPortInsert calls are expensive added
Actions
Copy link
 #4

Updated by Shivani Bhardwaj about 2 months ago

  • Status changed from In Review to Resolved
Actions
Copy link
 #5

Updated by Shivani Bhardwaj about 2 months ago

  • Label Needs backport to 7.0 added
Actions
Copy link
 #6

Updated by OISF Ticketbot about 2 months ago

  • Subtask #6830 added
Actions
Copy link
 #7

Updated by OISF Ticketbot about 2 months ago

  • Label deleted (Needs backport to 7.0)
Actions
Copy link
 #8

Updated by Shivani Bhardwaj about 2 months ago

  • Related to Bug #6843: detect/port: port ranges are incorrect when a port is single as well as a part of range added
Actions
Copy link
 #9

Updated by Shivani Bhardwaj about 1 month ago

  • Related to Bug #6881: detect/port: port grouping does not happen correctly if gap between a single and range port added
Actions
Copy link
 #10

Updated by Shivani Bhardwaj about 1 month ago

  • Related to Bug #6896: detect/port: upper boundary ports are not correctly handled added
Actions
Copy link
 #11

Updated by Victor Julien 17 days ago

  • Related to Bug #2908: ip only rules cause suricata to take 17 minutes to start added
Actions
Copy link

Also available in: Atom PDF