[Bro] PF_RING for Bro

[Robin Sommer]

(Note, I haven't caught up with the follow-up trehad yet).

>> 1. Send every packet belonging to a particular connection to the same  
>> core.
>> 2. Introduce a small wait on every packet to simulate Bro's processing  
>> of that packet? What will be a good value?

There probably isn't a good value. :-)

I think I'd start with two things:

(1) Just doing nothing in the threads, and

(2) Accessing all the packets' bytes in some form within the
threads, perhaps by calculating a simple checksum.

That should give you a good baseline, including an approximation of
memory effects in (2).

It will be interesting to see the differece between (1) and (2), and
also between them and a pure software version (copy the packets from
a master thread to child threads "manually", as the current
prototype is doing). 


On Mon, Dec 13, 2010 at 14:50 -0800, you wrote:

> Alternatively, can I have the source code for multi-threaded Bro? : )

You can, I'll send you another mail about that.

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org