[Snort-devel] Thoughts on threads

Martin Roesch roesch at ...48...
Sat Apr 7 00:09:45 EDT 2001


I've run gprof against Snort several times, at high speeds the
bottleneck is in the libpcap read() loop.  The time spent in the decoder
and detection engine is trivial by comparison, they're very fast (which
is why I haven't worried about making any mods to them in quite some
time).  The pa_engine idea is the way to go, we need faster packet
acquisition and validation (i.e. offloaded checksum validation).

    -Marty

Fyodor wrote:
> 
> >
> > In response to Fyodor's suggestion in regards profiling. Well, it just seems
> > like optimizing for the special case and that seems like a dubious idea.
> >
> 
> If I read the docs right (never had any profiling done in my life :P), profiling
> should show up how much CPU is currently being utilized by each part of snort during
> the execution, IMHO it might help us to evaluate which pieces are bottle necks and such..
> not very useful for threads pool case though (so my suggestion was abit biased, I guess, sorry) :)
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel




More information about the Snort-devel mailing list