# Question About Libsuricata Usage

**URL:** <https://forum.suricata.io/t/question-about-libsuricata-usage/4522>\
**Category:** Help\
**Created:** [March 13, 2024, 10:09am UTC](https://forum.suricata.io/t/question-about-libsuricata-usage/4522 "2024-03-13T10:09:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![hxndghxndg](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/hxndghxndg/32/2693_2.png) [@hxndghxndg](https://forum.suricata.io/u/hxndghxndg)\
**Post date:** [March 13, 2024, 10:09am UTC](https://forum.suricata.io/t/question-about-libsuricata-usage/4522/1 "2024-03-13T10:09:35Z")

</div>

Hello, everyone

Question:  
How to use libsuricata to build a detect engine? Is there any example or guidence?

Background:  
I build libsuricata lib to use it detect some new applayer packet  
After write a tcp server receiving network packet, detect these bytes by copy the code from ut, I find it will crash finaly,  
If i call InitGlobal() in suricata.c， it will crash later.

So how to use libsuricata?

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [March 13, 2024, 2:38pm UTC](https://forum.suricata.io/t/question-about-libsuricata-usage/4522/2 "2024-03-13T14:38:10Z")

</div>

This work is under active development so you are best to look at the relevant pull requests for more information, however we’re probably not where you need it to be yet.

Thats not to say others haven’t done this, but from a supported perspective its not there. You might want to look at this PR: [libsuricata: make the Suricata application a user of the Suricata library - v4 by jasonish · Pull Request #10578 · OISF/suricata · GitHub](https://github.com/OISF/suricata/pull/10578)

---

<div class="post-metadata">

**Author:** ![hxndghxndg](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/hxndghxndg/32/2693_2.png) [@hxndghxndg](https://forum.suricata.io/u/hxndghxndg)\
**Post date:** [March 15, 2024, 11:33am UTC](https://forum.suricata.io/t/question-about-libsuricata-usage/4522/3 "2024-03-15T11:33:51Z")

</div>

Thanks, I modified some global init part, paste the code of ut into detection thread, it seems works now.

But here comes the second question:

I add two different detection buffer on one custom tcp applaye, append 20,000 signatures to a detection context.  
when matching applayer packet, SigMatchSignatures take 15,000 us, I retest http header with 20,000 signatures, but it only take 150 us, Any idea what to do to accelarate the match process?

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [March 18, 2024, 7:59am UTC](https://forum.suricata.io/t/question-about-libsuricata-usage/4522/4 "2024-03-18T07:59:32Z")

</div>

Did you implement MPM for your new buffer?

---

<div class="post-metadata">

**Author:** ![hxndghxndg](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/hxndghxndg/32/2693_2.png) [@hxndghxndg](https://forum.suricata.io/u/hxndghxndg)\
**Post date:** [March 19, 2024, 8:28am UTC](https://forum.suricata.io/t/question-about-libsuricata-usage/4522/5 "2024-03-19T08:28:07Z")

</div>

Thanks ! seems MPM is problem here, I read the code of src/detect-http-uri.c, I guess ’ DetectAppLayerMpmRegister will register the mpm engine.

But I still can’t get how this match process , and where it init the mpm engine.

Any ideal of how this “magic” happened? Which file to read about this processing?