[Snort-devel] Snort-devel Digest, Vol 107, Issue 19

Russ rucombs at ...3461...
Mon Jul 6 09:00:49 EDT 2015


Here is my original response which inadvertently only went to Elof:

-------- Forwarded Message --------
Subject: 	Re: [Snort-devel] Snort++: how to get multithreading to work?
Date: 	Mon, 22 Jun 2015 12:04:41 -0400
From: 	Russ <rucombs at ...3461...>
To: 	elof at ...969...



Snort++ currently supports multiple packet threads, each with its own
source.  (A source could be an interface, pcap, etc.)  The processing of
any given packet is entirely within one of these threads, which means
that load balancing among cores/packet threads must be done externally.

In the coming months Snort++ will be updated to also support pipelined
packet processing to facilitate hardware offload and elephant flows (too
big for a single core).  We are also following open data plane and
hoping to support that.  As part of these changes we will tackle
internal load balancing which would support this users deployment.



On 7/6/15 3:56 AM, sunila sahu wrote:
> Here is my understanding of snort++ multithreading feature:
>
> Snort++ processes each input packet source on a separate instance by 
> binding a new analyzer thread to a freed cpu core providing 
> load-balancing across threads with a common snort configuration . But 
> there cant be multiple threads per single Packet source or single 
> interface.
>
> On Tue, Jun 23, 2015 at 5:30 PM, 
> <snort-devel-request at lists.sourceforge.net 
> <mailto:snort-devel-request at lists.sourceforge.net>> wrote:
>
>     Send Snort-devel mailing list submissions to
>     snort-devel at lists.sourceforge.net
>     <mailto:snort-devel at lists.sourceforge.net>
>
>     To subscribe or unsubscribe via the World Wide Web, visit
>     https://lists.sourceforge.net/lists/listinfo/snort-devel
>     or, via email, send a message with subject or body 'help' to
>     snort-devel-request at lists.sourceforge.net
>     <mailto:snort-devel-request at lists.sourceforge.net>
>
>     You can reach the person managing the list at
>     snort-devel-owner at lists.sourceforge.net
>     <mailto:snort-devel-owner at lists.sourceforge.net>
>
>     When replying, please edit your Subject line so it is more specific
>     than "Re: Contents of Snort-devel digest..."
>
>
>     Today's Topics:
>
>        1. Re: Snort++: how to get multithreading to work?
>     (elof at ...969... <mailto:elof at ...969...>)
>
>
>     ----------------------------------------------------------------------
>
>     Message: 1
>     Date: Mon, 22 Jun 2015 17:29:19 +0200 (CEST)
>     From: elof at ...969... <mailto:elof at ...969...>
>     Subject: Re: [Snort-devel] Snort++: how to get multithreading to work?
>     To: Russ <rucombs at ...3461... <mailto:rucombs at ...3461...>>
>     Cc: "Prude, Terrell \(SCC\)" <Terrell_Prude at ...3587...
>     <mailto:Terrell_Prude at ...3587...>>,
>             "snort-devel at lists.sourceforge.net
>     <mailto:snort-devel at lists.sourceforge.net>"
>             <snort-devel at lists.sourceforge.net
>     <mailto:snort-devel at lists.sourceforge.net>>
>     Message-ID:
>            
>     <alpine.BSF.2.00.1506221726170.71767 at ...3333...
>     <mailto:alpine.BSF.2.00.1506221726170.71767 at ...3333...>>
>     Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
>
>
>     Hi Russ!
>
>     Could you elaborate?
>
>     /Elof
>
>
>     On Wed, 17 Jun 2015, Russ wrote:
>
>     > Currently load balancing must be done externally which means you
>     get one
>     > packet thread per source.  If you have just one interface, one
>     packet thread
>     > is all you get.
>     >
>
>
>
>     ------------------------------
>
>     ------------------------------------------------------------------------------
>     Monitor 25 network devices or servers for free with OpManager!
>     OpManager is web-based network management software that monitors
>     network devices and physical & virtual servers, alerts via email & sms
>     for fault. Monitor 25 devices for free with no restriction.
>     Download now
>     http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
>
>     ------------------------------
>
>     _______________________________________________
>     Snort-devel mailing list
>     Snort-devel at lists.sourceforge.net
>     <mailto:Snort-devel at lists.sourceforge.net>
>     https://lists.sourceforge.net/lists/listinfo/snort-devel
>
>
>     End of Snort-devel Digest, Vol 107, Issue 19
>     ********************************************
>
>
>
>
> ------------------------------------------------------------------------------
> Don't Limit Your Business. Reach for the Cloud.
> GigeNET's Cloud Solutions provide you with the tools and support that
> you need to offload your IT needs and focus on growing your business.
> Configured For All Businesses. Start Your Cloud Today.
> https://www.gigenetcloud.com/
>
>
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20150706/3be245dc/attachment.html>


More information about the Snort-devel mailing list