> It is a different tradeoff: The worst case for a hash table would be a > lookup that takes O(n). While that's indeed the worst case, note that Bro uses randomized universal hash functions, so in practice you should never see such a run-time, even for maliciously crafted inputs. Vern