[Snort-devel] Thoughts on threads

Jon Bentley jon at ...370...
Fri Apr 6 14:00:10 EDT 2001

I haven't received a good beating recently, so I'll through my two cents
into the ring.

Threads (nee parallelization) would cause me some concern, as it would
potentially remove the serial order of received packets.  Perhaps that is
a concern of only myself, though.  (Packet sequence numbers, with a post-
process reordering?)

I'd rather see a thread dedicated to an atomic task, rather than full
execution.  This gives the ability to buffer individual task results, and so
basic prioritization among tasks.  (To wit, if a single thread processes
aspect of a packet, and I get hit with a burst of packets, I'm going to lose
However, if the front-end task merely traps and buffers packets, with a
priority thread doing post-processing, then bursts are no problem.)

Pthreads are great, but do we care about our W*ndows friends?

More information about the Snort-devel mailing list