Task #6586
Updated by Victor Julien 6 months ago
The "ac-bs" implementation is slower than the other implementations we support by a wide margin, so there is no reason to keep it around.
Xeon E5-2680v4
<pre>
profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 945 4361238 61719 24.8b 43.38
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401139 939 582339 25620 10.3b 38.00
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401142 951 4730010 24033 9.6b 36.30
profile-mpm-sandnet.pcap-open.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401144 939 35647355 12850 5.2b 28.97
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 948 21126890 78408 31.5b 43.38
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401140 987 1286478 34830 14.0b 38.87
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401142 960 5074068 32013 12.8b 37.64
profile-mpm-sandnet.pcap-pro.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401146 951 3292209 20061 8.0b 32.97
</pre>
AMD Threadripper 2990wx
<pre>
profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401143 1350 2435370 68706 27.6b 42.15
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401142 1350 2987040 25232 10.1b 33.12
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401140 1350 2496660 25391 10.2b 32.75
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401142 1350 2769840 91025 36.5b 40.58
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401142 1350 2841630 40201 16.1b 34.34
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401145 1350 2922510 39870 16.0b 33.18
</pre>
Rock 5b (arm64), unit is usecs instead of ticks, "hs" is vectorscan
<pre>
profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 399952 1 1315 39 15.6m 43.67
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 395419 1 1191 16 6.5m 37.97
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 395102 1 930 19 7.7m 38.22
profile-mpm-sandnet.pcap-open.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 400215 1 291 9 3.7m 31.62
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 400172 1 961 51 20.7m 44.57
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 397677 1 1218 25 10.0m 39.80
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 397701 1 832 26 10.7m 39.65
profile-mpm-sandnet.pcap-pro.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 400688 1 807 15 6.1m 35.44
</pre>
Xeon W-2245
<pre>
profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401143 1119 1380242 82818 33.2b 41.96
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 1042 753077 29483 11.8b 34.39
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401142 1095 582962 27795 11.2b 33.38
profile-mpm-sandnet.pcap-open.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 1259 334663 14925 6.0b 26.08
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 1089 2042454 107378 43.1b 41.52
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401145 1105 2740803 42612 17.1b 35.16
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 1081 1226400 38685 15.5b 33.38
profile-mpm-sandnet.pcap-pro.rules-hs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401139 1267 2384529 24090 9.7b 29.04
</pre>
Odroid HC1 (arm7), unit is usecs instead of ticks
<pre>
profile-mpm-sandnet.pcap-open.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 16 975 80 32.4m 18.13
profile-mpm-sandnet.pcap-open.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 16 885 54 21.8m 15.68
profile-mpm-sandnet.pcap-open.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401142 16 2935 53 21.5m 15.75
profile-mpm-sandnet.pcap-pro.rules-ac-bs/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401141 16 1770 106 42.7m 18.45
profile-mpm-sandnet.pcap-pro.rules-ac-ks/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401143 16 1912 68 27.6m 16.12
profile-mpm-sandnet.pcap-pro.rules-ac/packet_stats.log:PROF_DETECT_PF_PAYLOAD IPv4 6 401139 16 1456 67 27.2m 16.18
</pre>
In all tested cases and hw setups "ac-bs" is far slower than regular "ac", often by a wide margin.
Output generated with https://github.com/victorjulien/suricata/blob/experiment-ac-rust/v7/benches/profile-mpm.sh