Re: Multithreaded nDPI

On 08/03/2019 16:57, Alfredo Cardigliano wrote:

> processing traffic from a single interface with multiple streams/thread is similar
> to processing traffic from multiple interfaces with one thread per interface, as
> long as traffic is distributed across streams based on 5-tuple. This means that
> you need (to avoid locking, for performance) separate data structures including
> the ndpi struct.

So if a network endpoint now has several ndpi_id_structs (one for each 
thread) how does that impact protocol detection?  It looks like 
historical information is recorded in this struct which is used to help 
protocol detection in future flows - that will surely break if I can no 
longer guarantee that all of that endpoint's flows will be using the 
same ndpi_id_struct?

-- 
-- 
  - Steve Hill
    Technical Director | Cyfarwyddwr Technegol
    Opendium    Online Safety & Web Filtering     http://www.opendium.com
                Diogelwch Ar-Lein a Hidlo Gwefan

    Enquiries | Ymholiadau:   [email protected]     +44-1792-824568
    Support   | Cefnogi:      [email protected]   +44-1792-825748

------------------------------------------------------------------------
Opendium Limited is a company registered in England and Wales.
Mae Opendium Limited yn gwmni sydd wedi'i gofrestru yn Lloegr a Chymru.

Company No. | Rhif Cwmni:   5465437
Highfield House, 1 Brue Close, Bruton, Somerset, BA10 0HY, England.