search

hgn / captcp

A open source program for TCP analysis of PCAP files
http://research.protocollabs.com/captcp/
GNU General Public License v3.0
113 stars 40 forks source link

Improve the way connection uid is computed. #33

Closed kristahi closed 8 years ago

kristahi commented 8 years ago

uid is used as an index into the connections hashtable without checking for collisions. The hash function ought to be perfect in this case, but summing the ports isn't. Additionally, the aim of this hash function is to generate equal hashes for both subflows of a connection, ie. it must be the same regardless of the ordering of (dest, src) ports -- commutative, which summation is.

The new hash function for the port pair consists of ordering, then concatenating the port numbers. This ensures both a perfect hash (wrt. to connections, not subflows) and commutativity of the ports.

NB: I haven't changed the way the addresses are hashed, the same problem applies there.

Proposed fix for #32

hgn commented 8 years ago

Good catch Kristian!

that was my fault - I just thought about this combination although it is damn obvious! I quickly spotted over your patch, one question: is it not possible to get rid of https://github.com/hgn/captcp/blob/master/captcp.py#L2273 ?

Thank you Kristian!

kristahi commented 8 years ago

No problem, thank you for sharing this useful tool!

I just wondered what you mean by "getting rid of it"? Do you mean fixing the issue with collisions between IPs, or something else?