[Snort-devel] var PKT_TIMEOUT in sfdaq.c
maltizer at ...402...
Wed Feb 29 17:22:31 EST 2012
On 02/29/2012 05:00 PM, Guillaume Daleux wrote:
> Hi all,
> We had some problems with snort and snort daq which use 100% of
> processing power. After debugging, we saw that our system had a lot of
> call to poll function.
> The function poll (call in daq) set with a default snort parameter
> (PKT_TIMEOUT = 1000) is called everytime and didn't respect this
> timeout of 1 second (maybe heisenbug because only one printf removed
> this problem).
> We want to ask you, why this parameter is set to 1000 ms and not -1 ?
> The poll function is called to wait packets so why the snort daq uses
> a timeout and not directly value -1 which would block until a packet
> arrive ?
> Can we patch snort and change PKT_TIMEOUT to -1 ?
> Thanks for your answer.
Snort does certain "idle work" (see snort.c:SnortIdle()) each time the
DAQ acquire call returns. If you made the call fully blocking, it would
only return in the case of an error/signal/breakloop, and that code
would not execute [often enough] when the packet rate is too low.
I do not know why the timeout was being ignored in your case, which
seems to be the real issue. You have not mentioned which DAQ module you
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Snort-devel