Re: Snort-devel Digest, Vol 107, Issue 19

[Russ <rucombs () cisco com>]

Here is my original response which inadvertently only went to Elof:

-------- Forwarded Message --------
Subject:        Re: [Snort-devel] Snort++: how to get multithreading to work?
Date:   Mon, 22 Jun 2015 12:04:41 -0400
From:   Russ <rucombs () cisco com>
To:     elof () sentor se



Snort++ currently supports multiple packet threads, each with its own
source.  (A source could be an interface, pcap, etc.)  The processing of
any given packet is entirely within one of these threads, which means
that load balancing among cores/packet threads must be done externally.

In the coming months Snort++ will be updated to also support pipelined
packet processing to facilitate hardware offload and elephant flows (too
big for a single core).  We are also following open data plane and
hoping to support that.  As part of these changes we will tackle
internal load balancing which would support this users deployment.



On 7/6/15 3:56 AM, sunila sahu wrote:
> Here is my understanding of snort++ multithreading feature:
>
> Snort++ processes each input packet source on a separate instance by 
> binding a new analyzer thread to a freed cpu core providing 
> load-balancing across threads with a common snort configuration . But 
> there cant be multiple threads per single Packet source or single 
> interface.
>
> On Tue, Jun 23, 2015 at 5:30 PM, 
> <snort-devel-request () lists sourceforge net 
> <mailto:snort-devel-request () lists sourceforge net>> wrote:
>
>     Send Snort-devel mailing list submissions to
>     snort-devel () lists sourceforge net
>     <mailto:snort-devel () lists sourceforge net>
>
>     To subscribe or unsubscribe via the World Wide Web, visit
>     https://lists.sourceforge.net/lists/listinfo/snort-devel
>     or, via email, send a message with subject or body 'help' to
>     snort-devel-request () lists sourceforge net
>     <mailto:snort-devel-request () lists sourceforge net>
>
>     You can reach the person managing the list at
>     snort-devel-owner () lists sourceforge net
>     <mailto:snort-devel-owner () lists sourceforge net>
>
>     When replying, please edit your Subject line so it is more specific
>     than "Re: Contents of Snort-devel digest..."
>
>
>     Today's Topics:
>
>        1. Re: Snort++: how to get multithreading to work?
>     (elof () sentor se <mailto:elof () sentor se>)
>
>
>     ----------------------------------------------------------------------
>
>     Message: 1
>     Date: Mon, 22 Jun 2015 17:29:19 +0200 (CEST)
>     From: elof () sentor se <mailto:elof () sentor se>
>     Subject: Re: [Snort-devel] Snort++: how to get multithreading to work?
>     To: Russ <rucombs () cisco com <mailto:rucombs () cisco com>>
>     Cc: "Prude, Terrell \(SCC\)" <Terrell_Prude () scc senate gov
>     <mailto:Terrell_Prude () scc senate gov>>,
>             "snort-devel () lists sourceforge net
>     <mailto:snort-devel () lists sourceforge net>"
>             <snort-devel () lists sourceforge net
>     <mailto:snort-devel () lists sourceforge net>>
>     Message-ID:
>            
>     <alpine.BSF.2.00.1506221726170.71767 () farmermaggot shire sentor se
>     <mailto:alpine.BSF.2.00.1506221726170.71767 () farmermaggot shire sentor se>>
>     Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
>
>
>     Hi Russ!
>
>     Could you elaborate?
>
>     /Elof
>
>
>     On Wed, 17 Jun 2015, Russ wrote:
>
>     > Currently load balancing must be done externally which means you
>     get one
>     > packet thread per source.  If you have just one interface, one
>     packet thread
>     > is all you get.
>     >
>
>
>
>     ------------------------------
>
>     ------------------------------------------------------------------------------
>     Monitor 25 network devices or servers for free with OpManager!
>     OpManager is web-based network management software that monitors
>     network devices and physical & virtual servers, alerts via email & sms
>     for fault. Monitor 25 devices for free with no restriction.
>     Download now
>     http://ad.doubleclick.net/ddm/clk/292181274;119417398;o
>
>     ------------------------------
>
>     _______________________________________________
>     Snort-devel mailing list
>     Snort-devel () lists sourceforge net
>     <mailto:Snort-devel () lists sourceforge net>
>     https://lists.sourceforge.net/lists/listinfo/snort-devel
>
>
>     End of Snort-devel Digest, Vol 107, Issue 19
>     ********************************************
>
>
>
>
> ------------------------------------------------------------------------------
> Don't Limit Your Business. Reach for the Cloud.
> GigeNET's Cloud Solutions provide you with the tools and support that
> you need to offload your IT needs and focus on growing your business.
> Configured For All Businesses. Start Your Cloud Today.
> https://www.gigenetcloud.com/
>
>
> _______________________________________________
> Snort-devel mailing list
> Snort-devel () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------
Don't Limit Your Business. Reach for the Cloud.
GigeNET's Cloud Solutions provide you with the tools and support that
you need to offload your IT needs and focus on growing your business.
Configured For All Businesses. Start Your Cloud Today.
https://www.gigenetcloud.com/

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!