We've built community ID support into VAST to allow for pivoting between ingested PCAPs, Suricata, Zeek, and NetFlow/IPFIX. Our C++ implementation of community ID computation is available here.
We have observed approximately 8% loss in IPFIX ingestion performance when enabling community ID computation.
Recently we have experimented with replacing SHA1 in the community ID computation, and have had great results using xxHash. The overall performance loss went down from 8% to 3%.
I am proposing to use XXH3 (supposed to be stabilized in H1 2020) for community ID v2 to improve the usability on high-throughput paths.
We've built community ID support into VAST to allow for pivoting between ingested PCAPs, Suricata, Zeek, and NetFlow/IPFIX. Our C++ implementation of community ID computation is available here.
We have observed approximately 8% loss in IPFIX ingestion performance when enabling community ID computation.
Recently we have experimented with replacing SHA1 in the community ID computation, and have had great results using xxHash. The overall performance loss went down from 8% to 3%.
I am proposing to use XXH3 (supposed to be stabilized in H1 2020) for community ID v2 to improve the usability on high-throughput paths.