[Bro-Dev] new IPv6 code

[Seth Hall]

On Feb 8, 2012, at 6:02 PM, Siwek, Jonathan Luke wrote:

> topic/v6-addr
>    121142kb vsize, 309.33s user, 20.62s system
>    +0.5%mem, +45% cpu

The memory looks awesome, but that CPU increase really bothers me.

> About 65% of the time difference in either the IPv6-supporting configurations looks to be due to the fact that the size of Conn::Key exceeds UHASH_KEY_SIZE and so falls back on the slower HMAC/MD5 when creating a HashKey of the data, which happens for every packet.

Can we increase the size of the H3 hash keys?  I don't know enough about it to know what the ramifications of it would be or if it's even possible (but it seems to me like it should be possible from a quick read of h3.h).

> Maybe one possibility is that the scripts have changed so much since those benchmarks were run such that there's less state being tracked that involves addrs.

I suspect that's the case.

> And does it seem like a good idea to merge topic/v6-addr into master

I'd like to get it in there asap as long as there aren't any huge problems (the cpu utilization does still bother me a bit though).

  .Seth

--
Seth Hall
International Computer Science Institute
(Bro) because everyone has a network
http://www.bro-ids.org/