[Snort-devel] Re: [Snort-users] Has anybody checked this out?

Fyodor fygrave at ...121...
Fri Mar 2 02:22:31 EST 2001


On Thu, Mar 01, 2001 at 06:33:23PM -0500, Todd Lewis wrote:
> On Mon, 26 Feb 2001, Martin Roesch wrote:
> 
> > Fyodor wrote:
> > > 
> > > Another thought for snort2.x, what about having it threaded/MPI'ed? So people who manage to build unix clusters
> > > could take advantage of that while running snort? I am currently testing some code with MPI (bruth thing)
> > > and it works quite nifty.
> > 
> > All in good time.  We must balance uniprocessor vs SMP vs cluster
> > performance...
> 
> FWIW, I suspect that MPI wouldn't actually gain you anything, since
> you'd lose way more in your copying that you would gain by distribution.

IMHO logging (to a spooling module f.e.) could be done using MPI. Another use
of MPI which I could see is that we could organize packets parsing/proccessing
on round-robin manner, (either 'token' passing, or controlled by master). I am still
completing my reading on parallel programming though, so by the time I finish, I may
have some other ideas/thoughts as well :) 

Also I am not certain what are positives/negatives of using MPI vs. PVM since I
am just starting playing with both.

cheers,
-Fyodor




More information about the Snort-users mailing list