Saturday, March 12, 2005
Sunday, March 06, 2005
Nice Cg tutorial
Monday, February 28, 2005
Profiling Snort
1. change "configure" by adding "-pg" to the line: CFLAGS="-O2 -pg"
2. run the program for a while and then CTRL-C it. The signal handlers will ensure that snort
exits gracefully.
NOTE: you have to make sure you are using a suitable set of rules. This is the MOST important part
of this test since this will determine whether or not rule patter matching is used and to what extent.
Snort looks for either /etc/snort.conf or ./snort.conf. If your config lives elsewhere,
use the -c option to specify a valid config-file:
snort -c WHEREEVER/snort.conf
3. gprof snort [gmon.out] > snort.out
Wednesday, February 23, 2005
Ideas from GPGPU Forums:
GPGPU forum
woody said:
"Interesting idea. I haven't come across anything on this theme so far, but it has a lot of benefits.
I'm not sure what sort of performance you can achieve, but you could certainly do off-line packet analysis (eg. snort) operations, or do something like encoding 100 or so packets in rows in a texture and processing this texture once a second. So long as the processing time isn't greater then once a second, you're still processing every packet.
There's likely to be a few problems with recording information between rendering passes (say for classification/detection), but with MRT and RenderTextures (espec. with the soon-to-be-supported EXT_framebuffer_object extension), these should be able to be sorted out with minor detriment to performance. "
------------------------------
MRT (Mutliple Render to Texture):
RenderTexture:
EXT_framebuffer_object:
Tuesday, February 22, 2005
Snort on the GPU !!!
The idea is to try an implement the computationally intense portions in Snort on the GPU. Snort needs to operate at network speeds (gigabytes/sec) so much effort has gone into optimizing the Snort's packet scanner. Hopefully, the GPU can be used to really speed this up.
Some ideas/thoughts:
- The efforts the optimize the AC algorithm have focussed on encoding approaches, such as how the state machine is encoded. These usual rely on sparse-matrix or vector representations.
- the state-machine could be first encoded as a texture which is then accessed in a read-only fashion by texture sampling. Good idea.
Wednesday, February 16, 2005
Saturday, February 12, 2005
Snort on the GPU
This is a very interesting idea. Try to implement Snort functions as vertex/fragment shaders. I'm going to see if I can get a demo up an running.
Some options are:
- Using GLSL + ATI Radeon 9000 on Mac OS X
- Using Cg + NVidia FX 5200 on Linux
GLSL + Radeon 9000 + Mac OS X:
Try this first. Snort 2.3.0.
First trace through the Snort source to determine where a shader could exist.
Question: Does my Radeon 9000 support GLSL on Mac OS X???
Answer:
Cg + NVidia FX 5200 + Linux: