[Snort-devel] difference between pt_mpo_hash and pt_mpxo_hash in PortTable

Steven Sturges steve.sturges at ...402...
Fri Jul 16 14:31:58 EDT 2010


Two different hash tables to store two different types of
data.

mpo_hash is the merged set of Port Objects.

Whereas mpo_hash is the merged set of "list" objects.

See PortTableCompileMergePortObjects() in sfutil/sfportobject.c.

Cheers.
-steve

On 7/16/2010 12:39 PM, 邓伟锋 wrote:
> hello everyone,
>      now, I don't understand that when creating PortGroup structure for
> every PortObject2, we use the field pt_mpo_hash  hash table of PortTable
> structure(in the file fpcreate.c, function fpCreatePortTablePortGroups()),
> code as follow:
>  for (node=sfghash_findfirst(p->pt_mpo_hash);  //p->pt_mpxo_hash   what do
> the comment means?
>         node;
>         node=sfghash_findnext(p->pt_mpo_hash) ) //p->pt->mpxo_hash
> 
>  but when distrubuting  the PortGroup to ports, we use another field
> pt_mpxo_hash(in the file fpcreate.c, function fpCreateInitRuleMap())
>   for( node=sfghash_findfirst(src->pt_mpxo_hash);
>         node;
>         node=sfghash_findnext(src->pt_mpxo_hash) )
> 
> could anyone tell me this difference? thank you!
> 
> 
> 
> 
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> 
> 
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel




More information about the Snort-devel mailing list