[Snort-devel] Thoughts on threads

Jon Bentley jon at ...370...
Fri Apr 6 14:00:10 EDT 2001


I haven't received a good beating recently, so I'll through my two cents
into the ring.

Threads (nee parallelization) would cause me some concern, as it would
potentially remove the serial order of received packets.  Perhaps that is
a concern of only myself, though.  (Packet sequence numbers, with a post-
process reordering?)

I'd rather see a thread dedicated to an atomic task, rather than full
sequence
execution.  This gives the ability to buffer individual task results, and so
do
basic prioritization among tasks.  (To wit, if a single thread processes
every
aspect of a packet, and I get hit with a burst of packets, I'm going to lose
some.
However, if the front-end task merely traps and buffers packets, with a
lower
priority thread doing post-processing, then bursts are no problem.)

Pthreads are great, but do we care about our W*ndows friends?






More information about the Snort-devel mailing list