[flow-tools] performance question

[Mark Fullmer]

On Fri, Jan 24, 2003 at 10:17:55AM -0600, Craig A. Finseth wrote:

There is a potential performance increase if the results of a test
are cached, consider

match src-ip-addr test-address
match dst-ip-addr test-address
match exporter-ip-addr test-prefix
or
match src-ip-addr test-address
match exporter-ip-addr test-prefix
match src-ip-port test-port

Currently the src-ip-addr and exporter-ip-addr tests are done twice.
These results could be available in a cache with O(1) access (just need
to allocate enough buckets for the test conditions).

The other potential speedup is when accessing patricia trie's.  A hash
based cache could help here.  Using a better longest match lookup algorithm
could help too.

The first example is pretty far fetched because complex filter rules are
not typically used.  The second one is probably worth looking into.

mark

> To Vanish:
> 
> What's to cache with a flow-nfilter-type program?  It reads a file
> and writes a subset of the file: no flow is accessed more than once.
> 
> And, as far as caching the results of the test evaluations, in my case
> (which is what started this thread), I have a hard time seeing how a 
> cache would be less overhead than simply doing the test itself.
> 
> Craig