Re: R:Re: Questions about early_drop()

Re: R:Re: Questions about early_drop()

[Patrick McHardy]

pesce.luca@gmail.com wrote:
> Hi Patrick,
> thanks for the explanation. The only thing I do not understand is:
> 
>> It does greatly improve robustness under DoS since with jhash() and a
>> properly sized
>> hash table there's likely only a single entry per bucket.
> 
> I understand that this comes from hash tables theory, but I don't get
> it... When conntrack_core module is loaded, the maximum number of
> conntrack entries is calculated as (hashsize * 8), so when early_drop()
> kicks in, the table is full and is containing (hashsize*8) entries...
> how is it possible that in that situation every bucket contains just one
> entry? Shouldn't it contain about 8 entries, as a mean value?

The default is not properly sized, its a trade-off between memory
use and performance. A good size would be 2 * max_entries since
each conntrack is hashed twice.

Re: R:Re: Questions about early_drop()

[Luca Pesce]

On Thu, Nov 5, 2009 at 1:23 PM, Patrick McHardy <kaber@trash.net> wrote:
> The default is not properly sized, its a trade-off between memory
> use and performance. A good size would be 2 * max_entries since
> each conntrack is hashed twice.
>

Ok, I seem to understand: since each tuple is hased in the table,
actually the real table size is double of the nf_conntrack_max
parameter, so to have maximum performance (1 entry per bucket) we
should have a table with size = 2*nf_conntrack_max. Am I right?
Thank you very much for the explanation.
Luca