[Snort-devel] Multithreading in Snort?

Brian Caswell bmc at ...835...
Mon Jan 14 17:28:03 EST 2008


On Jan 12, 2008, at 2008/01/12 6:17 AM, Dirk Geschke wrote:
> the biggest problem is the libpcap: It ist not thread safe.
>
> So all threading could be done after the call to libpcap.
>
> In principle the preprocessors could be threaded, the detection
> engine and the output plugins. But some preprocessors require to
> be called in right order. This won't be easily be threadable.
>
> To get threadable preprocessors requires much work, stream5 won't
> be happy if some packets are in an other thread...
>
> So maybe you can start a thread after the preprocessors have done
> their work, the main process can return to wait for new packets.
>
> But I fear that this will not really make things better...

What he said.

In addition, frequent use of global variables is a concern.

Brian




More information about the Snort-devel mailing list