[kyrra]

Tangentially related, Snort was doing research to move to a multi-threaded architecture, but decided against it due to cache synchronization problems [1]. Though, their thoughts about splitting up processing was quite different than what the OP blog post suggests.

It looks like Snort gave up on one way of doing multi-threading, but they could still go the way suggested in the OPs post.

[1] http://securitysauce.blogspot.com/2009/04/snort-30-beta-3-re...

[robertgraham]

Yea, some engineers created a ground-up rewrite of Snort called "Suricata" that was multi-threaded, and therefore faster than Snort, which is only single-threaded. Suricata then failed to show any benchmark where they exceeded Snort's speed, and they fail to mention that Snort works fine on multi-core.

It's one of those things "everyone knows multi-threaded is better than single-threaded", but everyone's wrong.