Suricata 6, constant use CPU

Hello.

I am initiating me in the use of Suricata.

I have high use of CPU with version 6 under Windows, even when there is hardly traffic in the WiFi interface.

This occurs using Suricata-6.0.4-1-64bit.msi and Suricata-6.0.4-Windivert-1-64bit.msi.

This is a problem for me, since, in the CPU 5950x, it generates a 50W consumption, constantly with almost null wifi traffic.

I’m using NPCAP 1.60, I’ve tried using version 0.9984, but the suricata does not run.

I installed version 5 and the use of CPU when there is no WiFi traffic, it is 0.

Any idea about what I’m doing wrong?

Hí,

The same happens to me. I still haven’t gotten an answer as to why this happens.
if it helps you, with branch 5 it doesn’t happen. I have had to install branch 5 on all my windows.

This happens, above all, in windows servers. In some windows 10, the CPU is over 50%.
With branch 5, CPU usage is typically over 7/10%.

Possibly related Bug #4370: the latest release of Suricata V6.0.1 for Windows use high CPU - Suricata - Open Information Security Foundation

I’ve never tried to do perf analysis on Windows. Does anyone have experience with a tool similar to perf? I guess vtune?

1 Like

If I have some time I will study it

In catch, there are a lot of CPU cycles, in two threads that call the {endthreadex} function of msvcrt.dll

This is in another processor The i3 6100 in Windows Server, here obviously, due to the poor performance of the CPU, the Suricata uses 58%.

But as it is appreciated, maybe the problem is on how Suricata.exe calls and handles its dependence with Windows system modules.

That high consumption of cycles of the two threads, makes the 5950x in Windows 10, activate two cores in the 4.90GHz, there the consumption is triggered at 50W extras.

I want to clarify that, in the Table of Imports of suricata.exe, there is no call to {_endthreadex} in the msvcrt.dll section, so it must be an indirect call.

time after…

libwinpthread-1.dll calls the function {_endthread}

libwinpthread_1.dll is used Suricata 5 (which has no problems), is the same DLL that uses Suricata 6.

6ADCB208E578935B876A84F916D73BDE33793A34 * libwinpthread-1.dll
6ADCB208E578935B876A84F916D73BDE33793A34 * libwinpthread_1.dll.

1 Like