Suricata Multithreaded Architecture Requires More Memory and CPU Resources than Snort. We have seen that the overall use of Suricata by the processor was almost double that of Snort and Suricata used more than twice the amount of RAM used by Snort. It might be attributed to the overhead needed to handle multiple detection threads