> > > Everybody, have a look at http://bei.bof.de/ex1/. There's a bunch of
> > > pictures, which may become legible together with reading my recent
> > > mails on this thread.
>
> The only thing that looks really suspicious to me is the lump in
> original for large table sizes.
Note that due to the y-axis log-10 scale, the tail is more visible; the far
out tail does not consist of many buckets. I agree with your correlation
observation for the original hash. portscans, again?
With an overcrowded bucket table (the ~7000 entry cases), there is almost
no difference between the original hash, and the alternatives. They are
all equally bad (because of the overcrowding). With a wide bucket table
(130000 and 260000 buckets for 65000 entries), the general badness of
the original hash clearly shows in the shape of the curve.
> Have you tried the ABCD suggestion I posted?
> Just as a quick test:
> static u32 hash_conntrack(struct ct_key *key)
> {
> return
> 0x47441DFB * key->sip
> + 0x57655A7D * key->dip
> + 0x1C7F1D2D * key->sport
> + 0xDF91D738 * key->dport
> + key->proto;
I now added this to cttest (new hash called 'abcd'), and updated the
pictures on the website accordingly. Looks good for odd table sizes,
and detoriates badly for even table sizes - like you said.
best regards
Patrick
