Suricata

IIRC tags can only be set by rules, so we could also auto-detect that no tags are in use and skip the check? Possibly a per detect engine flag of sorts? Guess that could leave edge cases around reloads adding/removing tags. An other way we've dealt with cases like this in the past is a global atomic that counts tags in use, if it is 0, skip the lookup. The read is cheap, but if there are many tag operations the counter could be expensive.

There is a global counter of active host/session tags called num_tags. If num_tags == 0, then TagHandlePacket returns early, and there's no problem. But in my case, I have (third party) tag rules that are getting hit, so num_tags > 0, and the "rules use tags" flag you suggested would also be set.

When num_tags > 0, every packet does the source and destination host lookups. This seems wasteful because, in my configuration, tags don't affect Suricata's output. A fix for me would be either the configuration setting I proposed, or perhaps auto-detection based on whether tags can change the output (i.e. whether "tagged-packets" or "pcap-log conditional: tag" are configured).