From 49a280ff8d45b69710405f06e5b049ac656be80d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Edward=20Fjellsk=C3=A5l?= <edward.fjellskaal@gmail.com>
Date: Sat, 7 Jul 2012 11:00:58 +0200
Subject: [PATCH] Performance tweeks: - Made the default flow bucket bigger
 (BUCKET_SIZE). - Hashing of connections set to the 5-tuplets again.

---
 src/passivedns.c |  4 ++--
 src/passivedns.h | 18 +++++++++---------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/src/passivedns.c b/src/passivedns.c
index b78c14f..8764dfd 100644
--- a/src/passivedns.c
+++ b/src/passivedns.c
@@ -385,9 +385,9 @@ int connection_tracking(packetinfo *pi) {
 
     // find the right connection bucket
     if (af == AF_INET) {
-        hash = CXT_HASH4(IP4ADDR(ip_src),IP4ADDR(ip_dst));
+        hash = CXT_HASH4(IP4ADDR(ip_src),IP4ADDR(ip_dst),src_port,dst_port,pi->proto);
     } else if (af == AF_INET6) {
-        hash = CXT_HASH6(ip_src,ip_dst);
+        hash = CXT_HASH6(ip_src,ip_dst,src_port,dst_port,pi->proto);
     }
     cxt = bucket[hash];
     head = cxt;
diff --git a/src/passivedns.h b/src/passivedns.h
index d971541..f69ed9b 100644
--- a/src/passivedns.h
+++ b/src/passivedns.h
@@ -24,7 +24,7 @@
 /*  D E F I N E S  ************************************************************/
 #define VERSION                       "0.5.0"
 #define TIMEOUT                       60
-#define BUCKET_SIZE                   1211
+#define BUCKET_SIZE                   65536
 #define SNAPLENGTH                    1600
 #define PKT_MAXPAY                    255
 #define MAX_BYTE_CHECK                500000
@@ -338,25 +338,25 @@ typedef struct _connection {
 }
 #endif
 
-#define CXT_HASH4(src,dst) \
-   ((src + dst) % BUCKET_SIZE)
+#define CXT_HASH4(src,dst,sp,dp,pr) \
+   ((src + dst + sp + dp + pr) % BUCKET_SIZE)
 
 #ifndef OSX
-#define CXT_HASH6(src,dst) \
+#define CXT_HASH6(src,dst,sp,dp,pr) \
  (( \
   (src)->s6_addr32[0] + (src)->s6_addr32[1] + \
   (src)->s6_addr32[2] + (src)->s6_addr32[3] + \
   (dst)->s6_addr32[0] + (dst)->s6_addr32[1] + \
-  (dst)->s6_addr32[2] + (dst)->s6_addr32[3] \
- ) % BUCKET_SIZE)
+  (dst)->s6_addr32[2] + (dst)->s6_addr32[3] + \
+  sp + dp + pr ) % BUCKET_SIZE)
 #else
-#define CXT_HASH6(src,dest) \
+#define CXT_HASH6(src,dest,sp,dp,pr) \
  (( \
   (src)->__u6_addr.__u6_addr32[0] + (src)->__u6_addr.__u6_addr32[1] + \
   (src)->__u6_addr.__u6_addr32[2] + (src)->__u6_addr.__u6_addr32[3] + \
   (dst)->__u6_addr.__u6_addr32[0] + (dst)->__u6_addr.__u6_addr32[1] + \
-  (dst)->__u6_addr.__u6_addr32[2] + (dst)->__u6_addr.__u6_addr32[3] \
- ) % BUCKET_SIZE)
+  (dst)->__u6_addr.__u6_addr32[2] + (dst)->__u6_addr.__u6_addr32[3] + \
+  sp + dp + pr ) % BUCKET_SIZE)
 #endif
 
 typedef struct _packetinfo {