Ask Your Question

Should packet dissection be made multi-threaded?

asked 2020-02-08 02:04:20 +0000

Enger gravatar image

updated 2020-02-08 04:34:09 +0000

Guy Harris gravatar image

I had to ingest a large pcapng file file. It took many minutes. I pulled up the CPU monitor and noted that only ONE thread was pulling CPU, and it was MAXED-OUT. (source was Sammy SSD; not the bottleneck...)

I used GPU-caps and took at look at what was running on the two GPUs. NOT wireshark...

Given the wide popularity of Wireshark (many many people world wide use this program), isn't it worth the effort to modernize the program to be multi-threaded (and/or to draw upon resources of the GPUs)?

(Well, I tried to upload a screen-grab of the CPU monitor, but I don't have enough points. I also don't have my old account. I've reported to Wireshark previously, and had an account, but found it gone, and had to create a new one...)

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-02-08 04:33:45 +0000

Guy Harris gravatar image

isn't it worth the effort to modernize the program to be multi-threaded

Yes, it would be - but it's a significant effort, not just the result of sprinkling multi-threading pixie dust on the source code. Packet dissection is far from "embarrassingly parallel" - dissecting packet N may depend on the results of dissecting packet M, for M < N.

and/or to draw upon resources of the GPUs

Useful only if some part of dissection can be done better by a GPU than a CPU.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-02-08 02:04:20 +0000

Seen: 211 times

Last updated: Feb 08 '20