[Bro] A few questions

[Justin Azoff]

On Wed, Feb 03, 2010 at 09:58:02AM -0500, Seth Hall wrote:
> Yeah, the 8 is what I was referring to though.  The two directions of  
> traffic could go to different outputs because it would be hashing the  
> bytes of both IP addresses and would be two different values for the two 
> directions.

Yeah.. I thought that was the problem originally because the traffic was going
to different outputs, but it was just the offset that needed fixing..

The HashSwitch implementation in click adds each byte to generate the hash, so
A->B hashes to the same thing as B->A

It is a pretty dumb hash but it works well enough:

worker-1: 1265210113.069432 recvd=27566997
worker-2: 1265210113.080038 recvd=26377039
worker-3: 1265210113.013432 recvd=23995748


-- 
-- Justin Azoff
-- Security & Network Performance Analyst