[Snort-devel] Re: [Snort-users] Has anybody checked this out?

Todd Lewis tlewis at ...468...
Thu Mar 1 18:33:23 EST 2001


On Mon, 26 Feb 2001, Martin Roesch wrote:

> Fyodor wrote:
> > 
> > Another thought for snort2.x, what about having it threaded/MPI'ed? So people who manage to build unix clusters
> > could take advantage of that while running snort? I am currently testing some code with MPI (bruth thing)
> > and it works quite nifty.
> 
> All in good time.  We must balance uniprocessor vs SMP vs cluster
> performance...

FWIW, I suspect that MPI wouldn't actually gain you anything, since
you'd lose way more in your copying that you would gain by distribution.
You want your packet data examined locally to its acquisition point
to minimize the cost, and SMP (and maybe fast NUMA, but probably not)
really is the only way to do that parallelilously.

--
Todd Lewis
tlewis at ...468...





More information about the Snort-users mailing list