[Snort-devel] Optimized implementation of AC and AC_Q pattern matching algorithms

abed mohammad kamaluddin abedamu at ...2499...
Fri Jan 25 09:59:36 EST 2013


I have been working on porting snort to multicore MIPs (Octeon) processors
for high performance networks for which I have analyzed the existing
software pattern matching algorithms. Even though the focus is on using our
own proprietary hardware pattern matching engine (which gives more than
double the performance of the best software algorithm), we are supporting
all s/w algorithms on our port.

*While profiling Aho-Corasick based search (ac and ac-q) , it was found
that the number of instructions could be significantly reduced in the main
loop (the AC_SEARCH macros) if the next state was pre-fetched before it was
used. Each byte of Input passes through this loop, so the performance
increase is significant w.r.t to the present implementation. Unexpectedly
the gcc compiler is unable to perform this optimization on its own. *

Though simple optimization, it translates into more than 10-14% performance
jump. Also, this is not processor specific. I have tried on both 2U Dual
Intel Xeon Server and OCTEON68XX (32 core CAVIUM processor) for above
20Gbps line rates and I see the bump up. Also the same behavior is observed
for snort-2.9.0 to snort-2.9.4.

I am attaching the patch (w.r.t snort 2.9.4) , and would like to contribute
the same to OSS community.

Abed M K
Software Engineer
Cavium IDC
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20130125/d376540d/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: acsmx2_performance.patch
Type: application/octet-stream
Size: 1231 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20130125/d376540d/attachment.obj>

More information about the Snort-devel mailing list