Re: Multithreaded nDPI

> On 8 Mar 2019, at 18:13, Steve Hill <[email protected]> wrote:
> 
> On 08/03/2019 16:57, Alfredo Cardigliano wrote:
> 
>> processing traffic from a single interface with multiple streams/thread is similar
>> to processing traffic from multiple interfaces with one thread per interface, as
>> long as traffic is distributed across streams based on 5-tuple. This means that
>> you need (to avoid locking, for performance) separate data structures including
>> the ndpi struct.
> 
> So if a network endpoint now has several ndpi_id_structs (one for each thread) how does that impact protocol detection?  It looks like historical information is recorded in this struct which is used to help protocol detection in future flows - that will surely break if I can no longer guarantee that all of that endpoint's flows will be using the same ndpi_id_struct?

Yes, you need to avoid shuffling/mixing structs. Please see the ntopng code

Luca
> 
> -- 
> -- 
> - Steve Hill
>   Technical Director | Cyfarwyddwr Technegol
>   Opendium    Online Safety & Web Filtering     http://www.opendium.com
>               Diogelwch Ar-Lein a Hidlo Gwefan
> 
>   Enquiries | Ymholiadau:   [email protected]     +44-1792-824568
>   Support   | Cefnogi:      [email protected]   +44-1792-825748
> 
> ------------------------------------------------------------------------
> Opendium Limited is a company registered in England and Wales.
> Mae Opendium Limited yn gwmni sydd wedi'i gofrestru yn Lloegr a Chymru.
> 
> Company No. | Rhif Cwmni:   5465437
> Highfield House, 1 Brue Close, Bruton, Somerset, BA10 0HY, England.
> _______________________________________________
> Ntop-dev mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev