[Snort-users] Threaded Snort

Siddhartha Jain s_i_d_j at ...131...
Mon Mar 19 11:24:04 EST 2001

What i'd like to point out is that as my traffic grows and my CPU
utilization increases what will i do? Because adding CPUs probably won't
help. Doesn't this kind of limit Snort? From what i understand, threaded
applications scale well. Am i wrong?
I am using SnortSnarf to do reporting but that doesn't seem to be threaded
either and it goes upto 60% utilization for logs worth just 6MB. Again
having mutiple CPUs doesn't seem to help. Or does it?


----- Original Message -----
From: "Chris Green" <cmg at ...671...>
To: "Siddhartha Jain" <s_i_d_j at ...131...>
Cc: <snort-users at lists.sourceforge.net>
Sent: Monday, March 19, 2001 9:16 PM
Subject: Re: [Snort-users] Threaded Snort

> "Siddhartha Jain" <s_i_d_j at ...131...> writes:
> > Hi,
> >
> > Is Snort multithreaded? If not, does that mean i can move it from a
> > dual-processor box to a single-cpu box? Also, if its not multithreaded,
> > current cpu utilization on my box is 15% with low-traffic. As traffic
> > increases what can i expect?
> It is not multithreaded.  SMP buys you more processing power to do
> things with the logs but with 15% utilization and a plethora of
> machines, I'd find something else for that machine to do ;)
> --
> Chris Green <cmg at ...671...>

Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

More information about the Snort-users mailing list