Bug #6291
closed
Performance degradation on Suricata devices with a small number of rules
Added by Cole Dishington about 1 year ago.
Updated 4 months ago.
Description
Devices running a small number of rules, none of which being MPM-based rules, experienced a performance degradation of ~4%-16% throughput between Suricata 4 and Suricata 5 releases. The performance degradation is present in all releases past Suricata 5. The performance degradation was traced to:
0965afd66 detect: pkt inspect engines
The linked commit modified the default pkt inspection engines to be called through a function pointer. Previously, the default packet inspection errors were inlined.
Can you share some steps or details how to reproduce the performance degradation issue please?
How many rules/what type/what type of traffic/any specific run commands or config options enabled if relevant etc.
Thanks
Peter Manev wrote in #note-1:
Can you share some steps or details how to reproduce the performance degradation issue please?
How many rules/what type/what type of traffic/any specific run commands or config options enabled if relevant etc.
Thanks
I experienced the performance degradation when updating from Suricata 4.0.6 to Suricata 7.0.0, this performance degradation was noticed on a setup with the following:
- 176 signatures
- 3 are inspecting packet payload
- 33 inspect application layer
- 83 are decoder event only
The performance test used UDP, entirely traffic that would be detected as non-malicious, and Suricata running in IPS mode.
This performance impact was significant when running a small number of lightweight rules, but was not significant on larger (and more heavy-duty) rule sets. I have submitted a pull request (https://github.com/OISF/suricata/pull/9429) that changes the default packet inspection engines to inline, like they were in Suricata 4 before extra packet inspection engines were supported.
Thanks
- Target version changed from 7.0.1 to 7.0.2
- Target version changed from 7.0.2 to 7.0.3
- Target version changed from 7.0.3 to 8.0.0-beta1
- Status changed from New to In Review
- Related to Optimization #6728: detect: prefilter for events (decode, stream, app-layer, etc...) added
- Related to Optimization #7002: detect: move pseudo packet checks out of keyword Match funcs added
- Related to Bug #7106: packet: app-layer-events incorrectly used on recycled packets added
- Status changed from In Review to Closed
@Philippe Antoine I haven't yet been able to get the latest Suricata compiling with my toolchain (due to mismatch of archs in the lua .o files). I will re-test when I am able to get the newer versions of Suricata working with my toolchain, until then I will close of this issue. Thanks
Thanks Cole, you can also test with suricata-7.0.6
Also available in: Atom
PDF