community-id-spec icon indicating copy to clipboard operation
community-id-spec copied to clipboard

Published 20 hours ago • verified publisher icon corelight

Hash function performance

Open dominiklohmann opened this issue 4 years ago • 0 comments

We've built community ID support into VAST to allow for pivoting between ingested PCAPs, Suricata, Zeek, and NetFlow/IPFIX. Our C++ implementation of community ID computation is available here.

We have observed approximately 8% loss in IPFIX ingestion performance when enabling community ID computation.

Recently we have experimented with replacing SHA1 in the community ID computation, and have had great results using xxHash. The overall performance loss went down from 8% to 3%.

I am proposing to use XXH3 (supposed to be stabilized in H1 2020) for community ID v2 to improve the usability on high-throughput paths.

dominiklohmann avatar Mar 04 '20 12:03 dominiklohmann