Poor Performance When Using the 'flow' Keyword

Sure. This is my detect section in suricata.yaml:

detect:
  profile: medium
  custom-values:
    toclient-groups: 3
    toserver-groups: 25
  sgh-mpm-context: auto
  inspection-recursion-limit: 3000
  # If set to yes, the loading of signatures will be made after the capture
  # is started. This will limit the downtime in IPS mode.
  #delayed-detect: yes

and this is my ruleset file

suricata.rules (719.1 KB)