[Snort-devel] RE: A Proposal for Reengineering Snort's Packet Matching System - Comments

Fyodor fygrave at ...1...
Fri Apr 6 13:45:23 EDT 2001


 
> The problem to which I alluded is not any sort of lack of standardization.
> Rather, the issue is how you deploy your threads.  Do you generate
> one thread per packet?  Do you have a threadpool to which packets
> are dispatched on receipt?

I'd rather make parallel threads/processes for every task which snort is doing.. i.g.
packet capture - packet decoding - detection engine - logging, all these routines
could be papelined to increase productivity (IMHO), alternatively you could parallelize
things per-packet but will it really scale well?


-- 
http://www.notlsd.net
PGP fingerprint = 56DD 1511 DDDA 56D7 99C7  B288 5CE5 A713 0969 A4D1




More information about the Snort-devel mailing list