[Snort-devel] Threaded snort

Sjsnort sjsnort at ...398...
Fri Jun 15 05:59:38 EDT 2001


I can use pbind to bind snort to a processor but that won't help. Even
without pbind, it can utilize only one CPU and after binding it with pbind,
it would be only using one CPU. So no gain :)

whoa!!!!! I still did pbind and guess what? After binding snort to CPU-2, it
goes upto 80-90% usage (mpstat 5) and if i unbind it then the load seems to
get split, mpstat shows both processors getting loads between 30-60% (one
20%, the other 60% and various other combinations).

Whatever, pbind doesn't look like a good idea :)

Siddhartha

----- Original Message -----
From: "Erek Adams" <erek at ...105...>
To: "Sjsnort" <sjsnort at ...398...>
Sent: Friday, June 15, 2001 10:40 AM
Subject: Re: [Snort-devel] Threaded snort


> On Thu, 14 Jun 2001, Sjsnort wrote:
>
> > Well, i didn't go to SANS but from my CPU utilizations i do see a need
for
> > multi-threaded snort. More so because i run snort on a dual-processor
Sun
> > box and even with a low bandwidth 5-6 Mbps snort easily runs upto 60%
usage
> > (Snort-1.8beta6 Build 25). Although, i know that in the stable release
bugs
> > would be fixed and CPU utilization may come down but the point is that i
> > feel it is better to have single box (multi-processor) do as much
snorting
> > as it can before going to do things like split the traffic between
multiple
> > boxes (which by itself is a controversial topic)
>
> [...snip...]
>
> Siddharthay,
>
> If you bind snort to a proc with pbind, does that change the
> performance in any way?
>
> Just random thinking....
>
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net
>


_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com





More information about the Snort-devel mailing list