[Snort-devel] RE: A Proposal for Reengineering Snort's Packet Matching System - Comments
fygrave at ...1...
Fri Apr 6 13:45:23 EDT 2001
> The problem to which I alluded is not any sort of lack of standardization.
> Rather, the issue is how you deploy your threads. Do you generate
> one thread per packet? Do you have a threadpool to which packets
> are dispatched on receipt?
I'd rather make parallel threads/processes for every task which snort is doing.. i.g.
packet capture - packet decoding - detection engine - logging, all these routines
could be papelined to increase productivity (IMHO), alternatively you could parallelize
things per-packet but will it really scale well?
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7 B288 5CE5 A713 0969 A4D1
More information about the Snort-devel