> Please try this patch, it does: > * don't spin_lock on the update path unless entry > is missing > * increase size of hash table > * use jenkins hash which might distribute better > * run gc timer at fixed interval. I'll build a new kernel and let you know. Thanks. I've been working through the code and feel like I'm getting the feel of it. The key was the NF_HOOK macro. It's been ages since I wrote my own hash algorithm, so forgive a dumb question: will a larger hash perform faster? I only have a handful of mac addresses to hash. For me, ultimately this will be limited to 4 macs, one for each interface and one for the single device attached to each Ethernet segment.