Re: Snort as Gigabit Sensor

[Frank Knobbe <frank () knobbe us>]

On Thu, 2003-07-31 at 10:10, Chris Green wrote:
> > ... This leads me to... What about a threading snort.  I know this was
> > going on a while back but taken out... Why?
>
> Didn't work, unmaintained, highly increased portability barrier, code
> complexity.


heh... now you sparked my interest. What exactly "didn't work" in
threading Snort? Looking at the current source, I still see the function
"InterfaceThread", but no use of pthread as it was in Snort 1.9 (just
grepping at the moment). Running the packet capture per interface in
separate threads was a good idea (I haven't tried it myself though). And
the code didn't seem that much more complex either. 

What didn't work?

Regards,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part