Snort's "sfhashfcn" function and parameters

[James McLaughlin <jmclaughlin () maxeler com>]

I've been reading the source for the algorithm Snort uses to calculate
hashes of session keys. I'm curious about the rationale for the three
values chosen to parameterise it.

If sfhashfcn_static is used, we have:

seed     = 3193;
scale    = 719;
hardener = 133824503;

If not:

seed     = sf_nearest_prime( (rand()%m)+3191 );
scale    = sf_nearest_prime( (rand()%m)+709 );
hardener = (rand()*rand()) + 133824503;

I'm curious about the values, but in particular about a discrepancy between
the static and non-static values. In the non-static case, seed and scale
have to be prime numbers (and I'd be quite pleased if someone could explain
why!). In the static case, however, seed is a composite:

(3193 = 31 x 103)

James McLaughlin.

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!