[Bro-Dev] new IPv6 code

Seth Hall seth at icir.org
Wed Feb 8 18:59:23 PST 2012

On Feb 8, 2012, at 6:02 PM, Siwek, Jonathan Luke wrote:

> topic/v6-addr
>    121142kb vsize, 309.33s user, 20.62s system
>    +0.5%mem, +45% cpu

The memory looks awesome, but that CPU increase really bothers me.

> About 65% of the time difference in either the IPv6-supporting configurations looks to be due to the fact that the size of Conn::Key exceeds UHASH_KEY_SIZE and so falls back on the slower HMAC/MD5 when creating a HashKey of the data, which happens for every packet.

Can we increase the size of the H3 hash keys?  I don't know enough about it to know what the ramifications of it would be or if it's even possible (but it seems to me like it should be possible from a quick read of h3.h).

> Maybe one possibility is that the scripts have changed so much since those benchmarks were run such that there's less state being tracked that involves addrs.

I suspect that's the case.

> And does it seem like a good idea to merge topic/v6-addr into master

I'd like to get it in there asap as long as there aren't any huge problems (the cpu utilization does still bother me a bit though).


Seth Hall
International Computer Science Institute
(Bro) because everyone has a network

More information about the bro-dev mailing list