[Snort-devel] Threaded snort

Sjsnort sjsnort at ...398...
Fri Jun 15 05:59:38 EDT 2001

I can use pbind to bind snort to a processor but that won't help. Even
without pbind, it can utilize only one CPU and after binding it with pbind,
it would be only using one CPU. So no gain :)

whoa!!!!! I still did pbind and guess what? After binding snort to CPU-2, it
goes upto 80-90% usage (mpstat 5) and if i unbind it then the load seems to
get split, mpstat shows both processors getting loads between 30-60% (one
20%, the other 60% and various other combinations).

Whatever, pbind doesn't look like a good idea :)


----- Original Message -----
From: "Erek Adams" <erek at ...105...>
To: "Sjsnort" <sjsnort at ...398...>
Sent: Friday, June 15, 2001 10:40 AM
Subject: Re: [Snort-devel] Threaded snort

> On Thu, 14 Jun 2001, Sjsnort wrote:
> > Well, i didn't go to SANS but from my CPU utilizations i do see a need
> > multi-threaded snort. More so because i run snort on a dual-processor
> > box and even with a low bandwidth 5-6 Mbps snort easily runs upto 60%
> > (Snort-1.8beta6 Build 25). Although, i know that in the stable release
> > would be fixed and CPU utilization may come down but the point is that i
> > feel it is better to have single box (multi-processor) do as much
> > as it can before going to do things like split the traffic between
> > boxes (which by itself is a controversial topic)
> [...snip...]
> Siddharthay,
> If you bind snort to a proc with pbind, does that change the
> performance in any way?
> Just random thinking....
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net

Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

More information about the Snort-devel mailing list