ngrep icon indicating copy to clipboard operation
ngrep copied to clipboard

Port to PCRE2 API and enable JIT compilation

Open rfrancoise opened this issue 4 years ago • 0 comments

The original PCRE API provided on most systems by libpcre3 is no longer maintained upstream and is superseded by the new PCRE2 API, which was first released in 2015. pcre3 will be removed from Debian in 2023, as noted in this bug report: https://bugs.debian.org/1000080

This commit replaces the existing PCRE implementation with a new one using PCRE2, which is quite similar. One benefit is that PCRE2 provides a JIT compiler which can replace the interpretive regular expression evaluation code with native machine code on most modern platforms: https://pcre.org/current/doc/html/pcre2jit.html

Depending on the length and complexity of the pattern used, enabling JIT compilation makes Ngrep 50x to 150x faster, testing in quiet mode on a multi-gigabyte PCAP file stored on tmpfs.

rfrancoise avatar Nov 20 '21 23:11 rfrancoise