On Tue, 20 May 2003, Ethan Sommer wrote:
> I picked Spencer's mainly because it was a pain to port the glibc
> version into kernel space. They are both basically the posix regexp
> interface, so if someone wants to get another version working in kernel
> space we can test and see which one performs better with real load
> pretty easily.
>
Take a look at snorts implementation. I think snort is GPL so you may
just be able to borrow it.
>
> Yep. We haven't spent a lot of time on optimizations. Obviously that
> example can be fixed pretty quickly... except I'm not sure we can avoid
> it and stay thread safe? (linux can route multiple packets at the same
> time on an smp box right? so we can't just use a staically defined
> buffer...)
>
Your problem seesm to be the regexp scheme used. You dont need a static
buffer i think. You should be able to operate on an incoming packet
itself.
cheers,
jamal
|