[Snort-users] Threaded Snort

Chris Green cmg at ...671...
Mon Mar 19 11:29:09 EST 2001


"Siddhartha Jain" <s_i_d_j at ...131...> writes:

> What i'd like to point out is that as my traffic grows and my CPU
> utilization increases what will i do? Because adding CPUs probably won't
> help. Doesn't this kind of limit Snort? From what i understand, threaded
> applications scale well. Am i wrong?

Threaded applications scale well depending on how the problem is
approached.  Sometimes threads just get in your way.  Threading is one
of the things that will be tackled at some time in the future for
snort.

> I am using SnortSnarf to do reporting but that doesn't seem to be threaded
> either and it goes upto 60% utilization for logs worth just 6MB. Again
> having mutiple CPUs doesn't seem to help. Or does it?

Snortsnarf is a perl script.  The multiple CPUs would let you have one
cpu working on snortsnarf while the other CPU is working on snort and
the multitasking is handled by your OS's kernel. Adding threads for
the sake of adding threads can hurt and the thought power involved is
probably better spent on other more beneficial pursuits.
-- 
Chris Green <cmg at ...671...>
"Yeah, but you're taking the universe out of context."




More information about the Snort-users mailing list