Re: ip_conntrack_hash() problem

[Martin Wilck <Martin.Wilck@Fujitsu-Siemens.com>]

Am Mit, 2002-09-04 um 14.56 schrieb Harald Welte:

> It is an artificial case, in which you have a single client opening 
> thousands of connections to a single port on a singles server.  Please 
> correct me, if I misunderstood.

As I stated before, yes, it's artificial, but it is easy to come up with
real-world scenarios that come close. (proxy<->router<->webserver).

> > The fix is rather trivial (mainly the port numbers are accounted for
> > outside the ntohl() function), and therefore I'd like to ask again that
> > it be applied.
> 
> Would you be satisfied with making the default hashsize no longer a
> power of two?

I don't know. After all, users expect that if they set hashsize=4096,
the hashsize will be 4096. It should be possible to use that setting
without suffering extreme performance losses. IMO the right thing for
now is take the port numbers out of the ntohl() function.

> > Unless I am mistaken, the past discussions were mainly concerned with
> > fine-tuning of the hash function, which is a topic my patch doesn't
> > address, and can easily be done on top of it.
> 
> no, exactly the 'power-of-two' has been discussed as well.

Right. But as stated above, making certain hash sizes impossible would
change the usage. Are we sure that there are no user-space tools out
there that rely on the hashsize being equal to what they specify when
the module is loaded?

I think the hash function should be fixed, not the possible choice of
hash sizes, if that is at feasible.

Martin

-- 
Martin Wilck                Phone: +49 5251 8 15113
Fujitsu Siemens Computers   Fax:   +49 5251 8 20409
Heinz-Nixdorf-Ring 1	    mailto:Martin.Wilck@Fujitsu-Siemens.com
D-33106 Paderborn           http://www.fujitsu-siemens.com/primergy