pesce.luca@xxxxxxxxx wrote: > Hi Patrick, > thanks for the explanation. The only thing I do not understand is: > >> It does greatly improve robustness under DoS since with jhash() and a >> properly sized >> hash table there's likely only a single entry per bucket. > > I understand that this comes from hash tables theory, but I don't get > it... When conntrack_core module is loaded, the maximum number of > conntrack entries is calculated as (hashsize * 8), so when early_drop() > kicks in, the table is full and is containing (hashsize*8) entries... > how is it possible that in that situation every bucket contains just one > entry? Shouldn't it contain about 8 entries, as a mean value? The default is not properly sized, its a trade-off between memory use and performance. A good size would be 2 * max_entries since each conntrack is hashed twice. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
