[Bro] Multi-threading

[Robin Sommer]

Sorry for the delay. 

On Fri, Oct 08, 2010 at 16:39 -0700, Sunjeet Singh wrote:

> Can someone please comment on the current status of multi-threading in 
> Bro? I would be interested in doing some work here.

We have a proof-of-concept implementation of a multi-threaded Bro.
Even though still an early prototype, it already improves Bro's
performance quite a bit on multi-core systems and demonstrates that
the approach works quite well. However, this prototype still has a
number of limitations and is not yet usable from an operational
perspective. There are also a number of different routes we could go
from here, which aren't fully clear yet in their specifics.

For more background, the most current description of the prototype
is here:

     http://www.icir.org/robin/papers/cc-multi-core-icast.pdf
     
Section V. describes the parallelization approach, and Section VI.
presents some preliminary measurements. (Section I-IV are on a more
conceptual level; not all of that is directly reflected in Bro).

A limiting factor for moving this forward right now is available
time, so help and contributions would certainly be welcome. Is there
anything specific you're thinking about? (I saw your mail about
GPUs, will reply to that in a bit). 

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org