[Snort-devel] Multithreading in Snort?

Ragho Mahalingam mragho at ...2499...
Fri Jan 11 13:57:31 EST 2008


I know this topic may have been visited before, but I'm looking for
background on multithreading with Snort.  From the archives, it looks like
this topic was discussed in 2002 and 2004 but without any significant
detail.

Granted that this is a rookie question, what facets of Snort are MT
"unsafe?"  If I can assure packet ordering on a per-flow basis such that a
given flow always enters a given Snort thread, where is synchronization
required among multiple calls to PcapProcessPacket()?  Can folks who have
knowledge of Snort internals comment on specific considerations?

I am not looking for flames or "can't be done" comments.  I'd much prefer to
receive constructive knowledge to achieve this result.

Thanks, Ragho
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20080111/57ab1b99/attachment.html>


More information about the Snort-devel mailing list