inliniac/suricata — pull request #401 by poona (2013-06-22 06:55:14+00:00)
Title: Match on the MATCH list keywords first.

Theoretically MATCH list keywords are less processor intensive than the
rest and should offer better performance.

Was wondring if this patch makes sense. I have seen the no of rules with match list keywords and some of those keywords are flowbits/flowints checking if flags/vars are set. So moving it before the cpu intensive ones might offer some perf, although the pcap runs shows nothing.

Let's not push this yet. Would like to hear your ideas on this first.