Re: SMP Snort?

[Erek Adams <erek () snort org>]

On Fri, 7 Mar 2003, Wilcoxon, Steve wrote:

> Has anyone looked SMP enhancing Snort for high bandwidth situations.

It's been discussed quite a bit.  Check over on snort-devel for that [0]
thread.  ;-)

> I expect that there are several places that Snort could be broken into
> multiple threads to take advantage of SMP systems. I know it adds
> overhead, but considering how often I see people complaining about lost
> data or wanting to monitor large volumes of data, it might be worthwhile
> to consider.
>
> The trick is keeping it a single code base that doesn't slowdown single
> CPU systems if SMP isn't enabled at compile time.

The one thing that stands out to me, as a non-coder, is that will almost
force "two of everything" if it's to be kept in a single code tree.  One
decoder for single proc, one for SMP, etc...  The same applies to
preprocessors, and output plugins.  I know a lot could be IFDEFed, but
you'd be adding a large amount of code to an already complex setup.  Maybe
I just don't see it, since I don't do a lot of C coding, but it looks like
a _major_ undertaking.

> Flame me if you want for raising this question and not attempting to do
> it myself. I just thought it would be a useful discussion.

Nope.  Disscussion is the mother of all ideas.  :)  I'm just not swayed
over at this point.  :)

One thing that I know some people are doing to improve performance on SMP
boxes, is binding Snort to a single processor.  On some OS's, you can flag
a process never to swap, so that might be a help...  Though if Snort ever
swaps, something odd is going on.

Have a read over the thread(s) and see how it's been addressed so far.

Cheers!

-----
Erek Adams

   "When things get weird, the weird turn pro."   H.S. Thompson


[0]     http://marc.theaimsgroup.com/?l=snort-devel&w=2&r=1&s=threads&q=b


-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users