No performance improvements with Hyperscan

[zappasodi (zappasodi.dan)]

Hi Andreas,
thanks for your reply.

@Andreas_Herz

If build-info shows hyperscan it looks correct, you could run Suricata with -vvvv and check the log output as wlel if it mentions hyperscan.

In the log is not mentioned the word “hyperscan”, but I can see Debug messages from “mpm-hs”, I don’t know if this enough to say Suricata is working with hyperscan.

@Andreas_Herz

How did you actually measure the performance impact and are you certain that it was not enabled before, since Hyperscan is enabled by default if available?

I have tested 2 different Suricata on the same board, the first one compiled without hyperscan support:
Hyperscan support: no

and I did the test with this Suricata before the hyperscan installation on the board.

I tested several UDP traffic profiles (fixed frame 1528, fixed frame 85, iMix 420, …) and in all cases the maximum throughput decreases when I load more rules (decreases drastically with 35203 loaded rules).

With more rules loaded (from 115 rules on) I can see the {W#01} and {W#02} threads taking the biggest part of CPU resource.
I know this behaviour is normal, but what looks strange to me is that nothing changes with or without hyperscan (neither better, neither worst).

@Andreas_Herz

In addition to that Intel Atom C3338 is a 2 Core CPU without HT which is not a very fast one. So could be just the CPU being the bottleneck.

Yes, of course I don’t expect great performance on this kind of board, but all things considered, I supposed that the bottleneck is the rules handling so I also supposed that introducing the hyperscan should help.

Additional info:

Suricata is configured in IPS mode with NFQ.

I have upgraded Suricata from 7.0.0 to 7.0.2 yesterday and I’m observing better performances (the maximum throughput increases around 25%), but there are still no differences with or without Hyperscan.