[Oisf-users] Testers: please test our initial Hyperscan support

Viiret, Justin justin.viiret at intel.com
Wed Apr 6 06:41:25 UTC 2016

Hi Cooper,

> Well, that's the thing.  It's hard to measure real performance on modern
> super-scalar architectures, as the performance is dependent on lots of
> variables.  I/O, cache lines, pipelines, OOE, power-management, hyper-
> threading, etc.

True. And I'm guessing that because the deployment is an IDS with filtering to keep the load under control and variable traffic anyway, it's hard to gather comparative data about the throughput/packet rate actually passing through Suricata. 

> I ran the ac algo last night under a period of lighter load and it shows that it
> uses much more CPU time.

OK. Your profile looks to be in accordance with what we have observed here, too.

> The 'make install' failed, but it looks the libraries built so I just copied them
> over manually.  Performance is a little better, pertop output copied below.
> You can infer the relative amount of IP traffic by looking at the percentage of
> CPU time spent running the BPF filter.

Do you have any details on the 'make install' failure? If we have a build system issue, we'd like to reproduce it here and get it fixed.

Many thanks,

More information about the Oisf-users mailing list