[Snort-devel] The performance of Splay Tree and HASH

tlewis at ...255... tlewis at ...255...
Thu May 23 19:40:02 EDT 2002

On 24 May 2002 tanminger at ...1390... wrote:

>   I have made a simple testing, and found the performance of HASH is more 
> faster than Splay Tree, even if there is only one node in the Splay Tree
> and HASH.
>   I check the source of Splay Tree, comparing the root node in Splay Tree 
> need several function calls, it cost more CPU cycle than calculate the 
> hash key.
>   Using HASH maybe cause the DoS attack by sending special packets, but 
> can we using the HASH function based some random number?

My testing also showed that a hash table outperformed a splay tree.  I
agree with tanminger that seeding the hash function with a random value
can stop bucket overload attacks.

I did my testing many months ago.  tanminger (Sorry, your email doesn't
have your full name so I don't know what else to call you), do you have
numbers that you can post?

Todd Lewis
tlewis at ...255...

"Bonsoir, Monet.  Work, work.  It is the most beautiful thing there is
       in the world."  -- Clemenceau

More information about the Snort-devel mailing list