Suricata

master-6.0.x

$ hyperfine -m 3 -L rules ~/generated.rules,~/reordered.rules,~/suricata.rules './src/suricata -c suricata.yaml -S {rules} -r ~/scan.pcap -l /tmp/ll --runmode=single'
Benchmark 1: ./src/suricata -c suricata.yaml -S /home/jlucovsky/generated.rules -r ~/scan.pcap -l /tmp/ll --runmode=single
  Time (mean ± σ):     45.816 s ±  1.115 s    [User: 43.002 s, System: 5.996 s]
  Range (min … max):   44.546 s … 46.634 s    3 runs

Benchmark 2: ./src/suricata -c suricata.yaml -S ~/reordered.rules -r ~/scan.pcap -l /tmp/ll --runmode=single
  Time (mean ± σ):     25.846 s ±  0.270 s    [User: 22.881 s, System: 5.240 s]
  Range (min … max):   25.675 s … 26.158 s    3 runs

  Warning: Statistical outliers were detected. Consider re-running this benchmark on a quiet PC without any interferences from other programs. It might help to use the '--warmup' or '--prepare' options.

Benchmark 3: ./src/suricata -c suricata.yaml -S ~/suricata.rules -r ~/scan.pcap -l /tmp/ll --runmode=single
  Time (mean ± σ):     115.859 s ±  1.004 s    [User: 112.909 s, System: 6.942 s]
  Range (min … max):   114.760 s … 116.730 s    3 runs

Summary
  './src/suricata -c suricata.yaml -S ~/reordered.rules -r ~/scan.pcap -l /tmp/ll --runmode=single' ran
    1.77 ± 0.05 times faster than './src/suricata -c suricata.yaml -S /home/jlucovsky/generated.rules -r ~/scan.pcap -l /tmp/ll --runmode=single'
    4.48 ± 0.06 times faster than './src/suricata -c suricata.yaml -S ~/suricata.rules -r ~/scan.pcap -l /tmp/ll --runmode=single'

With cherry-picks:

 $ hyperfine -m 3 -L rules ~/generated.rules,~/reordered.rules,~/suricata.rules './src/suricata -c suricata.yaml -S {rules} -r ~/scan.pcap -l /tmp/ll --runmode=single'
Benchmark 1: ./src/suricata -c suricata.yaml -S /home/jlucovsky/generated.rules -r ~/scan.pcap -l /tmp/ll --runmode=single
  Time (mean ± σ):     26.139 s ±  0.387 s    [User: 23.192 s, System: 5.317 s]
  Range (min … max):   25.888 s … 26.585 s    3 runs

Benchmark 2: ./src/suricata -c suricata.yaml -S ~/reordered.rules -r ~/scan.pcap -l /tmp/ll --runmode=single
  Time (mean ± σ):     25.735 s ±  0.306 s    [User: 22.828 s, System: 5.165 s]
  Range (min … max):   25.500 s … 26.080 s    3 runs

Benchmark 3: ./src/suricata -c suricata.yaml -S ~/suricata.rules -r ~/scan.pcap -l /tmp/ll --runmode=single
  Time (mean ± σ):     85.347 s ±  3.070 s    [User: 81.791 s, System: 6.325 s]
  Range (min … max):   82.018 s … 88.066 s    3 runs

Summary
  './src/suricata -c suricata.yaml -S ~/reordered.rules -r ~/scan.pcap -l /tmp/ll --runmode=single' ran
    1.02 ± 0.02 times faster than './src/suricata -c suricata.yaml -S /home/jlucovsky/generated.rules -r ~/scan.pcap -l /tmp/ll --runmode=single'
    3.32 ± 0.13 times faster than './src/suricata -c suricata.yaml -S ~/suricata.rules -r ~/scan.pcap -l /tmp/ll --runmode=single'