[Snort-devel] Thoughts on threads

Fyodor fygrave at ...1...
Fri Apr 6 15:21:04 EDT 2001


On Fri, Apr 06, 2001 at 02:49:18PM -0400, Nash wrote:
> > If I read the docs right (never had any profiling done in my life :P), profiling
> > should show up how much CPU is currently being utilized by each part of snort during
> > the execution, IMHO it might help us to evaluate which pieces are bottle necks and such..
> > not very useful for threads pool case though (so my suggestion was abit biased, I guess, sorry) :)
> 
> Well, profiling is good knowledge. Don't get me wrong. When you're trying to kick the
> last ounce of performance out of your code its great stuff. I used it heavily the last
> time I wrote a stats engine for a web server.
> 
> But, if you use profiliing as the primary means of measuring the performance of your
> code then you optimize your code to the specific profiles you have in front of you. This
> is okay as long as the data generating your profile is the same as real world data. But,
> if the data has differences that affect performance you need more complex math to help
> you.
> 

I see. IMHO the data which we expect to be used to generated would be the same
as the 'real-world' data since we will probably be running compiled for
profiling snort binary on the real network. (althrough during last my testings
it slowed down the process alot, so I donno if profiled snort could really keep
up on a busy segment).

By the way you have any suggestions for more complex math except for manual
code analysis? :) Looks like you have got quite some experience with this :)





More information about the Snort-devel mailing list