Forest Global Training Partners

Cyber Risks · Cisco Talos

Single Threaded Data Processing Pipelines and the Intel Architecture

Summary: A Cisco Talos guest post by Marty Roesch argues that packet-processing performance on Intel CPUs depends on cache utilization and load allocation, not threading, and that Snort's single-threaded pipeline keeps its data resident on one core and in that cache. The post says Sourcefire sensors reach multi-gigabit performance by using a kernel-based load balancer to drive traffic to multiple single-core Snort instances, each handling over a gigabit per second per core.

What you should know: The post states that spreading one piece of data across multiple cores forces cache synchronization on every memory access, and that on multi-die CPUs those updates cross the slower front side bus, producing worst-case performance far below a single-threaded application doing the same work.

Read the original at Cisco Talos ↗

Topics
Malware
Related