OISF has launched a pilot collaboration with VectorCamp to support Vectorscan, the open-source engine behind Suricata’s fastest detection path.
At the heart of every Suricata deployment is a race against the wire. Traffic doesn’t wait, and the engine’s ability to keep pace with it – without dropping packets – depends on the performance of its hottest code paths. One of the most important of those paths is multi-pattern matching, and for years, that performance depended on a library whose future Suricata didn’t control.
The gap Vectorscan filled
Hyperscan – and by extension Vectorscan – is a high-performance, multi-regex matching library. It follows the regular expression syntax of the widely used libpcre library but is a standalone library with its own C API. Using hybrid automata techniques, it can simultaneously match tens of thousands of regular expressions, including across streams of data, which is why it’s a core component of DPI (deep packet inspection) stacks like Suricata’s.
When Intel stopped maintaining Hyperscan as open source, the security community lost more than a library – it lost guaranteed, long-term access to that class of high-performance pattern matching. Vectorscan emerged to fill that gap: a fully open-source, community-maintained continuation of the technology, free from the risk of being locked behind a proprietary, x86-only implementation.
For Suricata, that mattered immediately. Vectorscan now powers our multi-pattern matching – again, the hottest path in the engine – and delivers roughly 1.5x throughput over the alternatives. At scale, that difference is what separates keeping up with the wire from dropping packets.
Why we’re formalizing this
Open-source security tools are only as resilient as the components underneath them. Suricata’s performance profile is, in real terms, tied to Vectorscan’s health. That’s not a dependency we take lightly, and it’s why OISF began a pilot engagement this summer with founder Konstantinos Margaritis and VectorCamp – the sole maintainer and lead developer driving Vectorscan forward – to better understand where the project is headed and how OISF can best support it.
Expanding platform reach
One of the most tangible outcomes of this collaboration has been Vectorscan’s expanding platform support. It already runs on ARM/aarch64 and multiple platforms, extending high-performance matching beyond x86 deployments. And Windows support – long a gap for Suricata users on that platform – is nearly complete. Konstantinos expects full Windows UCRT64 support by the end of the month. That means the same high-performance matching Suricata users get on Linux and ARM will soon be available regardless of where they deploy.
What’s next
With Vectorscan maintained, portable, and now benefiting from an ongoing collaboration with OISF, we see an opportunity to lean into it more fully – extending its use into other areas of detection across the engine, and further raising the performance ceiling for the whole Suricata community. This collaboration also gives us a chance to look closely at Suricata-specific workloads and identify performance optimizations that are tailored to how our engine actually processes traffic, rather than relying solely on general-purpose gains.
This is exactly the kind of dependency stewardship OISF exists to enable: identifying the open-source components critical to Suricata’s performance and making sure they stay alive, well-maintained, and in the hands of people who keep them open. Vectorscan is a clear example, and we’re glad to be supporting it.
We’ll have more to share on this collaboration at SuriCon, where Konstantinos will present “Vectorscan: Past, Future and Collaboration with OISF.” The talk will cover Vectorscan’s origins as a portable, fully-compatible fork of Hyperscan – created in 2020 and now the only actively developed open-source alternative since Intel closed the original project in 2023 – along with its roadmap, the challenges faced along the way, and a deeper look at the new collaboration with OISF and what it means for Suricata’s performance going forward. Join us – https://suricon.net/.
About Konstantinos Margaritis and VectorCamp
Konstantinos Margaritis has over 20 years of experience in algorithm optimization using SIMD on both open-source and proprietary software on multiple platforms x86, Arm, Power and others. He is a Debian Developer since 1999, a Distinguished Arm Ambassador and also a Silver member of the ISA Working Group of OpenPower Foundation. He is the Founder and CTO of VectorCamp, a niche company that specializes in SIMD and Software Optimizations. VectorCamp is the creator of SIMD.info, the best online knowledge-base on SIMD intrinsics for all major architectures.