inliniac/suricata — pull request #1205 by ken-tilera (2014-11-05 22:28:17+00:00)
Title: MPM optimization replaces sigmask array with list of signature IDs matched

Rather than linearly search the array of bytes containing Signature Masks, the MPMs now maintain a list (array) of signature IDs matched. Since not all rules are triggered by the MPM, a separate list of non-MPM signatures is kept. After MPM matching, the two (sorted) lists are merged together into one sorted list with no duplicates.

Performance was measured on one set of input packets (HTTP traffic) using two suricata.yaml configurations.
1) Default suricata.yaml
2) changing HOME_NET=any and EXTERNAL_NET=any

The performance changes for the two cases using this patch vs master branch:
1) - 10.3% (master branch performance is better)
2) +54.9% (new optimization is better)

Passes PR scripts.
- PR build: https://buildbot.openinfosecfoundation.org/builders/ken-tilera/builds/42
- PR pcaps: https://buildbot.openinfosecfoundation.org/builders/ken-tilera-pcap/builds/48