[Snort-devel] initial results on benchmarking paengine code

Todd Lewis tlewis at ...120...
Thu Jan 18 23:38:37 EST 2001

On Thu, 18 Jan 2001, Martin Roesch wrote:

> Here's a question about SMP performance and Snort multithreading:
> If the OS doesn't handle SMP very well (*BSD on x86, Linux<2.4, etc),
> are there still going to be significant performance gains?  I'm not a
> big MP/multi-threading guru, but if the SMP implementations on these
> platforms are as limited as I've heard, how much gain are we really
> going to see?

There are all different ways to screw up threading.  Depending on how
threading is screwed up, performance is affected in different ways.

Take for example Linux (2.0 <= version <= 2.4).  These kernels fully
supported multithreading, but the networking code in the kernel was
serialized, so if your bottleneck was in the kernel networking code,
then threading wouldn't allow you to reach 100% utulization.  However,
you were still infinitely better off than on, say, NetBSD, which to my
understanding does not support SMP at all; the performance increase from
threading there is 0%.

Even on Linux 2.0, threading snort's packet handling would give an
improvement in performance, because you could take the computationally-
intensive packet analysis pieces and run them simultaneously on multiple
processors.  No, it wouldn't be as good as under 2.4, but it could still
be a significant speedup.  How significant of a speedup depends on what
relative percentage of CPU consumption the two tassks of (grabbing and
copying the packets in network processing) and (examining the packets
for rule matching) had.

I will be happy to provide real numbers on these issues when I start
working on the threading support in earnest.  I don't expect my stuff
to be accepted without performance numbers to justify them.

Todd Lewis                                       tlewis at ...120...

  God grant me the courage not to give up what I think is right, even
  though I think it is hopeless.          - Admiral Chester W. Nimitz

More information about the Snort-devel mailing list