(Note, I haven't caught up with the follow-up trehad yet).
> 1. Send every packet belonging to a particular
connection to the same
> 2. Introduce a small wait on every packet to simulate Bro's processing
> of that packet? What will be a good value?
There probably isn't a good value. :-)
I think I'd start with two things:
(1) Just doing nothing in the threads, and
(2) Accessing all the packets' bytes in some form within the
threads, perhaps by calculating a simple checksum.
That should give you a good baseline, including an approximation of
memory effects in (2).
It will be interesting to see the differece between (1) and (2), and
also between them and a pure software version (copy the packets from
a master thread to child threads "manually", as the current
prototype is doing).
On Mon, Dec 13, 2010 at 14:50 -0800, you wrote:
Alternatively, can I have the source code for
multi-threaded Bro? : )
You can, I'll send you another mail about that.
Robin Sommer * Phone +1 (510) 722-6541 * robin(a)icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org