[Oisf-devel] 77b708=WIN?

[Victor Julien]

On 10/04/2011 07:51 PM, Martin Holste wrote:
> PF_RING does a simple hash on srcip/dstip, so if suri does any more
> than that, it'll probably balance better.

Our trick is actually to hash based on the memory address of the flow
data structure:

    if (p->flow != NULL) {
#if __WORDSIZE == 64
        uint64_t addr = (uint64_t)p->flow;
#else
        uint32_t addr = (uint32_t)p->flow;
#endif
        addr >>= 7;

        uint16_t idx = addr % ctx->size;
        qid = ctx->queues[idx];
    }

It was done so we wouldn't need to lock the flow to access it while
still getting a stable hash.

This is not to be confused with the flow hash table btw. There we hash
on src,dst,sp,dp,proto iirc.

Cheers,
Victor


> On Tue, Oct 4, 2011 at 12:47 PM, Victor Julien <victor at inliniac.net> wrote:
>> On 10/04/2011 07:24 PM, Martin Holste wrote:
>>> I recommend switching to autofp from single for PF_RING.
>>
>> This is interesting. In the "single" mode we rely on PF_RING to load
>> balance the flows, right?
>>
>> In "autofp" mode, Suricata uses it's own loadbalancing mechanism. Does
>> it appear that ours is balancing more evenly? Would be surprising
>> considering how simple the hash is.
>>
>> Or are there other factors that I'm overlooking?
>>
>> Cheers,
>> Victor
>> --
>> ---------------------------------------------
>> Victor Julien
>> http://www.inliniac.net/
>> PGP: http://www.inliniac.net/victorjulien.asc
>> ---------------------------------------------
>>
>> _______________________________________________
>> Oisf-devel mailing list
>> Oisf-devel at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
>>
> 


-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------