inliniac/suricata — pull request #1214 by ken-tilera (2014-11-17 15:50:49+00:00)
Title: Dev mpm optimization v0.22 v5

Rather than linearly search the array of bytes containing Signature Masks, the MPMs now maintain a list (array) of signature IDs matched. Since not all rules are triggered by the MPM, a separate list of non-MPM signatures is kept. After MPM matching, the two (sorted) lists are merged together into one sorted list with no duplicates.

Performance was measured on one set of input packets (HTTP traffic) using two suricata.yaml configurations.
1) Default suricata.yaml
2) changing HOME_NET=any and EXTERNAL_NET=any

The performance changes for the two cases using this patch vs master branch:
1) - 7.2% (master branch performance is better)
2) +66.5% (new optimization is better)

PR Scripts pass:
https://buildbot.openinfosecfoundation.org/builders/ken-tilera-pcap/builds/57
https://buildbot.openinfosecfoundation.org/builders/ken-tilera/builds/51

Replaces PR: #1209