So I tested it once Hyperscan and TCMalloc seem to exclude each other. Interesting was the performance after I switched to ac_bnfa so Snort used TCMAlloc I think, I transferred 9 GB via Smb and Snort from the initial 15Mb (which corresponds to the performance of Hyperscan) the transfer rate increased to the end even to 16.4 Mb. So the longer the transfer the better it performs which is also the way TCMalloc works according to what I have read. The Cpu load was also definitely lower and the startup time as well. I would need a Snort version without Hyperscan only with TCMalloc to test against. If this is confirmed, I'd say throw Hyperscan out and use TCMalloc, especially since it's a problem that Hyperscan integrates the Cpu flags from the host build system cpu into the build.