[Snort-devel] Multithreading in Snort?

Brian Caswell bmc at ...835...
Mon Jan 14 17:28:03 EST 2008

On Jan 12, 2008, at 2008/01/12 6:17 AM, Dirk Geschke wrote:
> the biggest problem is the libpcap: It ist not thread safe.
> So all threading could be done after the call to libpcap.
> In principle the preprocessors could be threaded, the detection
> engine and the output plugins. But some preprocessors require to
> be called in right order. This won't be easily be threadable.
> To get threadable preprocessors requires much work, stream5 won't
> be happy if some packets are in an other thread...
> So maybe you can start a thread after the preprocessors have done
> their work, the main process can return to wait for new packets.
> But I fear that this will not really make things better...

What he said.

In addition, frequent use of global variables is a concern.


More information about the Snort-devel mailing list