Re: Snort-devel Digest, Vol 107, Issue 19

Here is my original response which inadvertently only went to Elof:

-------- Forwarded Message --------
Subject: 	Re: [Snort-devel] Snort++: how to get multithreading to work?
Date: 	Mon, 22 Jun 2015 12:04:41 -0400
From: 	Russ <[email protected]>
To: 	[email protected]



Snort++ currently supports multiple packet threads, each with its own
source.  (A source could be an interface, pcap, etc.)  The processing of
any given packet is entirely within one of these threads, which means
that load balancing among cores/packet threads must be done externally.

In the coming months Snort++ will be updated to also support pipelined
packet processing to facilitate hardware offload and elephant flows (too
big for a single core).  We are also following open data plane and
hoping to support that.  As part of these changes we will tackle
internal load balancing which would support this users deployment.



On 7/6/15 3:56 AM, sunila sahu wrote:
> Here is my understanding of snort++ multithreading feature:
>
> Snort++ processes each input packet source on a separate instance by 
> binding a new analyzer thread to a freed cpu core providing 
> load-balancing across threads with a common snort configuration . But 
> there cant be multiple threads per single Packet source or single 
> interface.
>
> On Tue, Jun 23, 2015 at 5:30 PM, 
> <[email protected] 
> <mailto:[email protected]>> wrote:
>
>     Send Snort-devel mailing list submissions to
>     [email protected]
>     <mailto:[email protected]>
>
>     To subscribe or unsubscribe via the World Wide Web, visit
>     https://lists.sourceforge.net/lists/listinfo/snort-devel
>     or, via email, send a message with subject or body 'help' to
>     [email protected]
>     <mailto:[email protected]>
>
>     You can reach the person managing the list at
>     [email protected]
>     <mailto:[email protected]>
>
>     When replying, please edit your Subject line so it is more specific
>     than "Re: Contents of Snort-devel digest..."
>
>
>     Today's Topics:
>
>        1. Re: Snort++: how to get multithreading to work?
>     ([email protected] <mailto:[email protected]>)
>
>
>     ----------------------------------------------------------------------
>
>     Message: 1
>     Date: Mon, 22 Jun 2015 17:29:19 +0200 (CEST)
>     From: [email protected] <mailto:[email protected]>
>     Subject: Re: [Snort-devel] Snort++: how to get multithreading to work?
>     To: Russ <[email protected] <mailto:[email protected]>>
>     Cc: "Prude, Terrell \(SCC\)" <[email protected]
>     <mailto:[email protected]>>,
>             "[email protected]
>     <mailto:[email protected]>"
>             <[email protected]
>     <mailto:[email protected]>>
>     Message-ID:
>            
>     <[email protected]
>     <mailto:[email protected]>>
>     Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
>
>
>     Hi Russ!
>
>     Could you elaborate?
>
>     /Elof
>
>
>     On Wed, 17 Jun 2015, Russ wrote:
>
>     > Currently load balancing must be done externally which means you
>     get one
>     > packet thread per source.  If you have just one interface, one
>     packet thread
>     > is all you get.
>     >
>
>
>
>     ------------------------------
>
>     ------------------------------------------------------------------------------
>     Monitor 25 network devices or servers for free with OpManager!
>     OpManager is web-based network management software that monitors
>     network devices and physical & virtual servers, alerts via email & sms
>     for fault. Monitor 25 devices for free with no restriction.
>     Download now
>     http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
>
>     ------------------------------
>
>     _______________________________________________
>     Snort-devel mailing list
>     [email protected]
>     <mailto:[email protected]>
>     https://lists.sourceforge.net/lists/listinfo/snort-devel
>
>
>     End of Snort-devel Digest, Vol 107, Issue 19
>     ********************************************
>
>
>
>
> ------------------------------------------------------------------------------
> Don't Limit Your Business. Reach for the Cloud.
> GigeNET's Cloud Solutions provide you with the tools and support that
> you need to offload your IT needs and focus on growing your business.
> Configured For All Businesses. Start Your Cloud Today.
> https://www.gigenetcloud.com/
>
>
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!