choose block mode or stream mode? about hyperscan HOT 1 CLOSED

Hi,

(I think we've also discusses this on email, as well)

Hyperscan supports start of match (SOM) in all of its modes of operation (block, streaming, vectored), so the decision about which mode to use depends on how your data is organised.

If you have all the data you want to scan in one block, then block mode will be most appropriate (and probably fastest). If you have all the data at one time, but it is in different blocks in memory, then you can use vectored mode (rather than copying them into one big block).

If you do not have all the data at once, then streaming mode is probably what you want. You should keep in mind that the SOM reported for a given match may be in an earlier block in the stream -- you if you wish to use the data corresponding to a match you may need to buffer enough stream history to retrieve it.

We have more information about Hyperscan's runtime mode in the documentation: http://01org.github.io/hyperscan/dev-reference/runtime.html

from hyperscan.