[Bro] Use of GPUs for signature matching?

[Robin Sommer]

On Mon, Oct 18, 2010 at 10:31 -0700, Sunjeet Singh wrote:

> I believe that GPUs can be used here to perform parallel signature 
> matching by different protocol analyzers, thus speeding up the protocol 
> analysis phase. 

That's generally right and, as the Snort work demonstrates,
parallelizing signature matching across GPUs can indeed improve 
performance quite a bit. For Bro, however, improving signature
performance is actually not that crucial as its main performance
bottlenecks are elsewhere (the single most important bottleneck
today is the script interpreter). 

Thus, while generally improving the performance of Bro's signature
engine would certainly still be nice (and I appreciate your interest
in helping with this!), I'm not sure it's actually worth spending
the time that a solid GPU-based implementation would require.

I'd be happy to provide you with some further thoughts on directions
you could work on for improving Bro's performance. Write me a mail
off-list if you're interested. 

Robin

-- 
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org 
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org