# Long \`HOME\_NET\` list leads to very slow startup times?

**URL:** <https://forum.suricata.io/t/long-home-net-list-leads-to-very-slow-startup-times/3332>\
**Category:** Help\
**Created:** [March 17, 2023, 5:01pm UTC](https://forum.suricata.io/t/long-home-net-list-leads-to-very-slow-startup-times/3332 "2023-03-17T17:01:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![scottmudge](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/scottmudge/32/1931_2.png) [@scottmudge](https://forum.suricata.io/u/scottmudge)\
**Post date:** [March 17, 2023, 5:01pm UTC](https://forum.suricata.io/t/long-home-net-list-leads-to-very-slow-startup-times/3332/1 "2023-03-17T17:01:52Z")

</div>

Standard version 7.0.0-rc1 installation, mostly default config with EmergingThreats open ruleset installed via `suricata-update`.

When using the default `HOME_NET` set (maybe 2 or 3 entries), Suricata seems to take 3 seconds or so to startup and start processing the requested input.

However, if I add the 40 or so subnets which I would like to be considered ‘internal’, the startup time balloons to like 45 seconds, sometimes longer.

I’m assuming it has to do with parsing/compiling all of the rules (delay happens after SigAddressPrepareStage1 entry in suricata.log), but my main concern is if there is going to be a similar amount of overhead in the processing of the rules against the network traffic as well? Or is it only a cost at startup?

Is this kind of behavior expected? I noticed the same with v6.0.8 I believe as well.

---

<div class="post-metadata">

**Author:** ![IDSTower](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/idstower/32/861_2.png) [@IDSTower](https://forum.suricata.io/u/IDSTower)\
**Post date:** [March 17, 2023, 6:00pm UTC](https://forum.suricata.io/t/long-home-net-list-leads-to-very-slow-startup-times/3332/2 "2023-03-17T18:00:55Z")

</div>

It should speed up the detection, especially if your rules use home\_net variable extensively, since a big portion of the traffic will not be matched against.

---

<div class="post-metadata">

**Author:** ![scottmudge](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/scottmudge/32/1931_2.png) [@scottmudge](https://forum.suricata.io/u/scottmudge)\
**Post date:** [March 17, 2023, 6:26pm UTC](https://forum.suricata.io/t/long-home-net-list-leads-to-very-slow-startup-times/3332/3 "2023-03-17T18:26:11Z")

</div>

Good to know. So it’s more of an ‘upfront cost’ then with respect to startup time.

Is the slow startup with a long list of `HOME_NET` subnets a normal thing?

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [March 18, 2023, 1:13pm UTC](https://forum.suricata.io/t/long-home-net-list-leads-to-very-slow-startup-times/3332/4 "2023-03-18T13:13:59Z")

</div>

Can you post your HOME\_NET values here? Of course, redact sensitive information but give enough info so we can get the gist of it:  
`HOME_NET: [subnet1.x.y.z/16,...]` or whatever you’re using?