# Creating new Val() in multi-threaded bro **URL:** \ **Category:** Zeek\ **Created:** [April 22, 2007, 8:13pm UTC](https://community.zeek.org/t/creating-new-val-in-multi-threaded-bro/1167 "2007-04-22T20:13:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Vishal\_Verma](https://avatars.discourse-cdn.com/v4/letter/v/48db29/32.png) [@Vishal\_Verma](https://community.zeek.org/u/Vishal_Verma)\ **Post date:** [April 22, 2007, 8:13pm UTC](https://community.zeek.org/t/creating-new-val-in-multi-threaded-bro/1167/1 "2007-04-22T20:13:22Z")
Bro Gurus, I'm trying to make Bro run multi-threaded... so wanted to ask if you guys have any experience with that. First of all, is Bro written to be multi-threaded? If not, can you guys point me to the places which would need some work to make it multi-threaded. Apparently with the complex interplay of data structures, it is hard to find those. I have fixed one such place in Type.cc in: BroType\* base\_type(TypeTag tag) where it was using a static base\_types array. There may more lurking elsewhere, which I haven't been able to find. Esp, I'm facing this issue, where I'm trying to create a new Val() object and bro coredumps in one of the threads. thanks! -y ---
**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\ **Post date:** [April 23, 2007, 10:55pm UTC](https://community.zeek.org/t/creating-new-val-in-multi-threaded-bro/1167/2 "2007-04-23T22:55:54Z")
Hi, > Bro Gurus, > > I'm trying to make Bro run multi-threaded... so wanted to ask if you > guys have any experience with that. First of all, is Bro written to be > multi-threaded? Not currently, no. > If not, can you guys point me to the places which > would need some work to make it multi-threaded. Apparently with the > complex interplay of data structures, it is hard to find those. I have > fixed one such place in Type.cc in: > BroType\* base\_type(TypeTag tag) > where it was using a static base\_types array. There may more lurking > elsewhere, which I haven't been able to find. > > Esp, I'm facing this issue, where I'm trying to create a new Val() > object and bro coredumps in one of the threads. There are surely many places in the code in which static variables may collide with multi-threaded operation. There will also be a number of synchronization issues. The real question is what you are actually trying to achieve, so you can adjust the architecture to run the relevant tasks in separate threads. This may be non-trivial. That said, it would clearly be interesting to parallelize the operation of individual analyzers, for example. Cheers, Christian ---
**Author:** ![Vishal\_Verma](https://avatars.discourse-cdn.com/v4/letter/v/48db29/32.png) [@Vishal\_Verma](https://community.zeek.org/u/Vishal_Verma)\ **Post date:** [April 24, 2007, 2:57pm UTC](https://community.zeek.org/t/creating-new-val-in-multi-threaded-bro/1167/3 "2007-04-24T14:57:08Z")
I'm playing with the idea of remotely controlling Bro operation/configuration. Sorry, I'm not interested in Broccoli as that is a non-standard interface. For that I'm creating a separate thread that accepts SOAP messages and controls Bro on-the-fly. I could really do it as a single thread, but it's cleaner the other way. I'm curious though, if the broccoli interface/api is a binary or a text one! Your idea of parallelizing the various analyzers is something I have considered. Really, it'll only make sense parallelizing the analyzers on a single packet. Analyzing multiple packets at the same instant would create synchronization problems of their own sort. What if the analysis of second packet ends up finishing before the first though it was dependent on the first? This is true not just for packets from same connection. Distinct connections may be related too and may need synchronous processing. Talking of analyzing single packets (at an instant) using multiple analyzers, don't know how beneficial that is really. Can't think of too many cases where this is helpful. Especially, even in these cases, after analyzing the first packet, mostly only a single analyzer remains interested. And from what I know, subsequent packets belonging to the same connection can re-use the analyzer information stored in the connection entry. Having said that, parallelizing Event dispatches would be interesting, since there's no guarantee of order in Event Handler execution for a given event anyways. cheers -y ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [April 24, 2007, 8:32pm UTC](https://community.zeek.org/t/creating-new-val-in-multi-threaded-bro/1167/4 "2007-04-24T20:32:13Z")
> Sorry, I'm not interested in Broccoli as that > is a non-standard interface. For that I'm creating a separate thread > that accepts SOAP messages and controls Bro on-the-fly. Well sorry likewise, as we won't be interested in your possible contribution in that case. > Your idea of parallelizing the various analyzers is something I have > considered. Really, it'll only make sense parallelizing the analyzers > on a single packet. Please see our papers which explore the possibilities in depth:   Rethinking Hardware Support for Network Analysis and     Intrusion Prevention,   V. Paxson et al., Proc. USENIX Hot Security, August 2006.   [http://www.icir.org/vern/papers/hotsec06.pdf](http://www.icir.org/vern/papers/hotsec06.pdf)   An Architecture for Exploiting Multi-Core Processors to     Parallelize Network Intrusion Prevention,   V. Paxson, R. Sommer, and N. Weaver,   Proc. IEEE Sarnoff Symposium, May 2007, to appear.   [http://www.icir.org/vern/papers/multicore-sarnoff07.pdf](http://www.icir.org/vern/papers/multicore-sarnoff07.pdf) - Vern ---
**Author:** ![Vishal\_Verma](https://avatars.discourse-cdn.com/v4/letter/v/48db29/32.png) [@Vishal\_Verma](https://community.zeek.org/u/Vishal_Verma)\ **Post date:** [April 25, 2007, 5:28am UTC](https://community.zeek.org/t/creating-new-val-in-multi-threaded-bro/1167/5 "2007-04-25T05:28:51Z")
> \> Sorry, I'm not interested in Broccoli as that > \> is a non-standard interface. For that I'm creating a separate thread > \> that accepts SOAP messages and controls Bro on-the-fly. > > Well sorry likewise, as we won't be interested in your possible contribution > in that case. I hope my comment didn't come across as forthright sacrilege, or a snide advice for that matter. I just meant that requirements differ in my case. I trust that Broccoli does well at what it is inteded to. > Please see our papers which explore the possibilities in depth: Thanks for the pointers to these. -y ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/creating-new-val-in-multi-threaded-bro/1167/6 "2022-05-06T15:38:15Z")