Re: stream based av and snort/Stream5

["Randal T. Rioux" <randy () procyonlabs com>]

On Tue, March 9, 2010 10:22 am, lynch.meng wrote:
> hello all! I am working for develop a snort preprosessor to do stream
> based anti virus. I need do mime decodeing and decompress, so reassembled
> packets should come to my preprosessor sequentially. client side packet
> have no problem, but i can not get packet with PKT_REBUILT_STREAM flags
> from server side?

As Snort is not currently multi-threaded, wouldn't this have terrible
consequences when larger files are encountered?

Then again, does the threading factor even matter? I'm not too familiar
with the internals of preprocessors (do/can they lock?).

Randy



------------------------------------------------------------------------------
Download Intel® Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev
_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel