inliniac/suricata — pull request #82 by poona (2012-09-21 16:36:36+00:00)
Title: Give priority to non stream content over stream content when selecting fast pattern

If a signature has non_negated non_raw_stream_contents, they are given priority over the raw_stream_contents while selecting the fast pattern.

The idea is adding more non_raw_stream fast_patterns should be better wrt performance. Of course this might backfire on certain cases, but in general it should work better imo.

I have checked against 2 pcaps. Gives around 2-3% improvement. No issues with alerts. I would like to give it a run on more pcaps to verify the perf/alerts.