[Snort-devel] Optimized implementation of AC and AC_Q pattern matching algorithms
abed mohammad kamaluddin
abedamu at ...2499...
Sat Jan 26 13:42:21 EST 2013
I have compiled using default options - i.e. using -O2 flag for running on
Intel Machines, no other specific option and it is easily reproducible. For
other processors we use some processor-specific flags.
For profiling I used in-house proprietary profiling tools. I used both daq
pcap as well as network traffic generated using our own traffic generators.
However I feel any traffic which passes through ac/ac-q should give same
Abed M K
On Fri, Jan 25, 2013 at 9:10 PM, Hui Cao <hcao at ...402...> wrote:
> Hi Abed,
> Thanks for the patch. I will create a bug to track this.
> What's the compiling option for your testing? How did you profiling
> the performance? Knowing those might help us verify the performance
> On Fri, Jan 25, 2013 at 9:59 AM, abed mohammad kamaluddin
> <abedamu at ...2499...> wrote:
> > Hi,
> > I have been working on porting snort to multicore MIPs (Octeon)
> > for high performance networks for which I have analyzed the existing
> > software pattern matching algorithms. Even though the focus is on using
> > own proprietary hardware pattern matching engine (which gives more than
> > double the performance of the best software algorithm), we are supporting
> > all s/w algorithms on our port.
> > While profiling Aho-Corasick based search (ac and ac-q) , it was found
> > the number of instructions could be significantly reduced in the main
> > (the AC_SEARCH macros) if the next state was pre-fetched before it was
> > Each byte of Input passes through this loop, so the performance increase
> > significant w.r.t to the present implementation. Unexpectedly the gcc
> > compiler is unable to perform this optimization on its own.
> > Though simple optimization, it translates into more than 10-14%
> > jump. Also, this is not processor specific. I have tried on both 2U Dual
> > Intel Xeon Server and OCTEON68XX (32 core CAVIUM processor) for above
> > line rates and I see the bump up. Also the same behavior is observed for
> > snort-2.9.0 to snort-2.9.4.
> > I am attaching the patch (w.r.t snort 2.9.4) , and would like to
> > the same to OSS community.
> > Regards
> > --
> > Abed M K
> > Software Engineer
> > Cavium IDC
> > Master Visual Studio, SharePoint, SQL, ASP.NET, C# 2012, HTML5, CSS,
> > with LearnDevNow - 3,200 step-by-step video tutorials by Microsoft
> > MVPs and experts. ON SALE this month only -- learn more at:
> > http://p.sf.net/sfu/learnnow-d2d
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-devel
> > Archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
> > Please visit http://blog.snort.org for the latest news about Snort!
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel