Hello, dear colleagues. While researching suricata rules profiling, I encountered a question that I cannot clarify without your experience and knowledge.
Only one rule is loaded.
alert tcp any any <> any any (flow:established; content:“Q”; fast_pattern; content:“AAAAAA”; sid:1;)
Using netcat, I transfer a txt file with the contents QQQQQQQQQQAAAAAAQQQQQQQQQQQ.
I receive the following profiling data.
rule_perf.log (4.1 KB)
My question is: what causes such a high number of checks? Is it the MPM mechanism? Then why are there so few matches? How does it work? Please explain. Thank you.