| Main Archive Page > Month Archives > snort-devel archives |
Re: [Snort-devel] Multithreading in Snort?
From: Brian Caswell <bmc_at_nospam>Date: Mon Jan 14 2008 - 22:28:03 GMT
To: Dirk Geschke <dirk@geschke-online.de>
On Jan 12, 2008, at 2008/01/12 6:17 AM, Dirk Geschke wrote:
> the biggest problem is the libpcap: It ist not thread safe.
>
> So all threading could be done after the call to libpcap.
>
> In principle the preprocessors could be threaded, the detection
> engine and the output plugins. But some preprocessors require to
> be called in right order. This won't be easily be threadable.
>
> To get threadable preprocessors requires much work, stream5 won't
> be happy if some packets are in an other thread...
>
> So maybe you can start a thread after the preprocessors have done
> their work, the main process can return to wait for new packets.
>
> But I fear that this will not really make things better...
What he said.
In addition, frequent use of global variables is a concern.
Brian
Check out the new SourceForge.net Marketplace. It's the best place to buy or sell services for just about anything Open Source.
http://ad.doubleclick.net/clk;164216239;13503038;w?http://sf.net/marketplace
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel