[Snort-devel] The performance of Splay Tree and HASH

tlewis at ...255... tlewis at ...255...
Thu May 23 19:40:02 EDT 2002


On 24 May 2002 tanminger at ...1390... wrote:

>   I have made a simple testing, and found the performance of HASH is more 
> faster than Splay Tree, even if there is only one node in the Splay Tree
> and HASH.
> 
>   I check the source of Splay Tree, comparing the root node in Splay Tree 
> need several function calls, it cost more CPU cycle than calculate the 
> hash key.
> 
>   Using HASH maybe cause the DoS attack by sending special packets, but 
> can we using the HASH function based some random number?

My testing also showed that a hash table outperformed a splay tree.  I
agree with tanminger that seeding the hash function with a random value
can stop bucket overload attacks.

I did my testing many months ago.  tanminger (Sorry, your email doesn't
have your full name so I don't know what else to call you), do you have
numbers that you can post?

--
Todd Lewis
tlewis at ...255...

"Bonsoir, Monet.  Work, work.  It is the most beautiful thing there is
       in the world."  -- Clemenceau





More information about the Snort-devel mailing list